pyproject.toml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

[project]
name = "nemoplatform"
description = "NeMo Platform"
readme = "README.md"
requires-python = ">=3.12,<3.15"
license = "Apache-2.0"
license-files = ["LICENSE", "NOTICE"]

classifiers = [
  "Development Status :: 4 - Beta",

  "Intended Audience :: Developers",
  "Intended Audience :: Science/Research",
  "Topic :: Scientific/Engineering :: Artificial Intelligence",
  "Topic :: Scientific/Engineering :: Human Machine Interfaces",
  "Topic :: Software Development",

  "License :: OSI Approved :: Apache Software License",

  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Programming Language :: Python :: 3.14",
]

# Root workspace dependencies - minimal set for workspace tooling only.
# Service packages are NOT listed here - they're defined in dependency-groups
# for container builds. This allows --only-group to work correctly.
dependencies = [
  "base58>=2.1.1",
  "fastapi[standard]==0.138.0",
  "uvicorn[standard]>=0.12.0",
  "sacrebleu",
  "jinja2==3.1.6",
  "h11>=0.16.0",
  "protobuf<7.0.dev0,>=6.33.5", # fix for GHSA OOS
  "pyyaml>=6.0.2",
  "pydantic>=2.12.0",
  "mypy-extensions==1.0.0",
  "tornado>=6.5.7",             # pinned for CVE GHSA-7cx3-6m66-7c5m (>=6.5.0) + GHSA-qjxf-f2mg-c6mc (<=6.5.4, fixed in 6.5.5)
  "tomlkit>=0.13.3",
  "nmp-guardrails",
  "nmp-hello-world",
  "nmp-intake",
  "nmp-core-mcp",
  "nemo-platform",
  "nemo-platform-ext",
  "nmp-common",
  "garak-api",
  "nmp-platform",
  "nmp-platform-seed",
  "nmp-secrets",
  # Core services needed for OpenAPI generation (platform imports these dynamically)
  "nmp-auth",
  "nmp-models",
  "models",
  "nmp-files",
  "nmp-inference-gateway",
  "nmp-jobs",
  "nmp-entities",
  "orjson>=3.11.6",
  "hvac>=2.3.0",
  "nmp-studio",
  "nmp-platform-runner",
  "requests>=2.33.1",
]
version = "0.0.0"

[dependency-groups]
# Insights analyst plugin convenience group.
insights = ["nemo-insights-plugin"]
# Experimentalist and Eval Author support Python 3.12 and 3.13. Both are listed so the
# `nemo agents eval-author` commands are installed alongside Experimentalist. The
# dependency is one arrow: Eval Author borrows the Experimentalist platform client
# (see plugins/nemo-eval-author/README.md).
experimentalist = [
  "nemo-experimentalist-plugin ; python_full_version < '3.14'",
  "nemo-eval-author-plugin ; python_full_version < '3.14'",
]
typecheck = ["transformers>=5.5.0,<5.9.0"]
# The scaled-evals plugin stays out of `enabled-plugins` so a platform install does not
# pick it up. CI still has to see it, so the lint and pytest entry points ask for this
# group by name; without it neither the plugin nor psycopg is importable there.
scaled-evals = [
  "nemo-scaled-evals-plugin",
]
dev = [
  "pre-commit>=3.8.0",
  "pydantic-settings>=2.6.1",
  "pytest-asyncio>=0.24.0",
  "pytest-cov>=6.0.0",
  "pytest-env>=1.1.0",
  "pytest-subtests>=0.13.1",
  "pytest-rerunfailures>=14.0",
  "pytest-timeout>=2.3.1",
  "pytest>=9.0.3",
  "fastapi[standard]==0.138.0",
  "papermill>=2.6.0",
  "aiohttp>=3.14.1",
  "ipykernel>=6.29.5",
  "ty==0.0.56",
  "hatchling>=1.26.3",
  "nmp-testing",
  "mlflow-skinny>=3.15.0,<3.16.0", # Optional dep for fine-tuning (shipped in training images); skinny variant to test API surface without bloating uv.lock
  "nemo-platform-plugin",          # Optional runtime dep; included here for type checking
  # Needed so the plugin's unit tests can import it. Safe to install: the plugin never imports
  # iron-swarm itself, which stays in its own venv (garak pulls litellm/torch, incompatible pins).
  "nemo-iron-swarm-plugin",
  "nvidia-nat-atif>=1.9.0a20260811,<1.10", # ATIF schema models for agentic-use trajectory validation
  "nemo-platform-sdk-tools",               # Include SDK/license tool migration target for testing
  "nmp-build-tools",                       # Build hook helpers imported by package-local hatch_build.py files
  # Out-of-tree Experimentalist strategy. Without it installed, the tests proving a third-party
  # package can ship a component skip silently -- which is how a broken one went unnoticed.
  "acme-strategies ; python_full_version < '3.14'",
  "nmp-dev-mcp",                                    # Include MCP dev tools
  # These are the dev dependencies from `sdk/python/nemo-platform`.
  # Including here until we find a better way to include them.
  "pyright==1.1.399",
  "mypy",
  "respx",
  "pytest",
  "pytest-asyncio",
  "ruff==0.15.7",
  "time-machine",
  "nox",
  "dirty-equals>=0.6.0",
  "importlib-metadata>=6.7.0",
  "rich>=13.7.1",
  "ruamel.yaml>=0.18.0",
  "typer>=0.9.0",
  "nest_asyncio==1.6.0",
  "pytest-xdist>=3.6.1",
  "pytest-mock>=3.14.1",
  "pytest-httpserver>=1.0.0",
  "aioresponses>=0.7.8",
  "httpx-aiohttp>=0.1.8",
  "aiosqlite>=0.20.0",
  "greenlet>=3.0.0",
  # nemo-nb/docs dependencies
  "nemo_nb",
  "myst-parser>=4.0.0",
  "sphinx-design>=0.6.0",
  "python-dotenv>=1.2.2",
  # Service packages for local development (not in root deps to allow --only-group in containers)
  "nemo-anonymizer-plugin",
  "nemo-data-designer-plugin[retrieval-sdg]",
  "nmp-guardrails",
  "nemo-safe-synthesizer-plugin",
  "nmp-hello-world",
  "nmp-intake",
  "nmp-core-mcp",
  "nemo-platform",
  "nemo-platform-ext",
  "nmp-common",
  "nmp-platform",
  "nmp-secrets",
  "blockbuster>=1.5.26",
  "ipywidgets>=8.1.9",
]

# =============================================================================
# Container Build Dependency Groups
# =============================================================================
# These groups define which packages to install for each container type.
# Each group is self-contained and does NOT inherit from the root project deps.
#
# Usage in Dockerfile (use --only-group to exclude root project deps):
#   uv sync --frozen --only-group core-services --no-editable
#   uv sync --frozen --only-group functional-services --no-editable
#   uv sync --frozen --only-group cpu-tasks --no-editable
#   uv sync --frozen --only-group gpu-tasks --no-editable
# =============================================================================

# Base dependencies for all Python containers.
# Keep both CLIs available in every image: `nemo` for service startup and
# `nemo-platform` for task-oriented backward compatibility.
# nemo-platform-plugin provides the runtime interfaces used by first-party plugins bundled into images.
# Each container group explicitly lists only the services it needs.
nmp-base = [
  "nmp-common",
  "nemo-platform",
  "nmp-platform",
  "nemo-platform-plugin",
]

# Extra runtime needed specifically for `nemo services run` in service images.
nmp-services-runtime = ["nemo-platform[services]"]

# First-party plugins installed by default for local syncs and core service images.
enabled-plugins = [
  "nemo-anonymizer-plugin",
  "nemo-data-designer-plugin[retrieval-sdg]",
  "nemo-evaluator-plugin",
  "nemo-insights-plugin",
  "nemo-experimentalist-plugin ; python_full_version < '3.14'",
  "nemo-guardrails-plugin",
  "nemo-auditor-plugin",
  "nemo-safe-synthesizer-plugin",
  "nemo-switchyard",
  "nemo-agents-plugin",
  "nemo-deployments-plugin[docker,k8s]",
  "nemo-customizer-plugin",
  "nemo-automodel-plugin",
  "nemo-optimization-plugin",
  "nemo-unsloth-plugin",
  "nemo-rl-plugin",
]

# Legacy runtime needed specifically for task images that still invoke
# `nemo-platform run task` for backwards compatibility.
nmp-task-runtime = ["nmp-platform"]

# Core infrastructure services (for the core-services container set)
# These are the minimal services needed for core platform functionality
core-services = [
  { include-group = "nmp-base" },
  { include-group = "nmp-services-runtime" },
  "nmp-auth",
  "nmp-models",
  "nmp-files",
  "nmp-inference-gateway",
  "nmp-jobs",
  "nmp-secrets",
  "nmp-entities",
  { include-group = "enabled-plugins" },
]

# All functional services (for nmp-api container)
# Includes core services plus all application services
functional-services = [
  { include-group = "core-services" },
  # Ship the openshell deployment SDK in the nmp-api image only. The extra carries
  # platform-restricted wheels (manylinux_2_39 / macOS 13 arm64) and is deliberately
  # kept out of `enabled-plugins` so bare `uv sync` on unsupported hosts (older glibc,
  # older macOS) does not hard-fail. The api image runs on a compatible base.
  "nemo-deployments-plugin[openshell]",
  "nmp-studio",
  "nmp-guardrails",
  "nemo-data-designer-plugin[retrieval-sdg]",
  "nemo-anonymizer-plugin",
  "nmp-intake",
  "nmp-hello-world",
  "nmp-platform-seed",
]

# CPU task dependencies (for nmp-cpu-tasks container)
# Services that have CPU-only batch tasks
cpu-tasks = [
  { include-group = "nmp-base" },
  { include-group = "nmp-task-runtime" },
  "nemo-anonymizer-plugin",
  "nemo-data-designer-plugin[retrieval-sdg]",
  "nemo-optimization-plugin",
  "nmp-hello-world",
]

# Task runtime for agent-evaluate jobs that orchestrate sandboxed Gym runs.
# Keep this exact environment separate from cpu-tasks because it additionally
# needs the Evaluator plugin and OpenSandbox SDK.
gym-task-orchestrator = [
  { include-group = "cpu-tasks" },
  "nemo-evaluator-plugin",
  "sandboxed-gym[opensandbox]",
]

# GPU task dependencies (for nmp-gpu-tasks container)
# Services that have GPU-intensive batch tasks
gpu-tasks = [
  { include-group = "nmp-base" },
  { include-group = "nmp-task-runtime" },
  "nmp-models",
]


[project.scripts]
generate-config-docs = "script.generate_config_docs:main"

[tool.uv]
prerelease = "if-necessary-or-explicit"
index-strategy = "unsafe-best-match"
required-version = ">=0.9.14"
cache-keys = [{ file = "pyproject.toml" }]
# Keep uv's implicit dev default and also install enabled plugins on bare `uv sync`.
default-groups = ["dev", "enabled-plugins"]
# this section is used to constrain the uv lockfile generation to specific environments
# which is very useful for debugging resolution issues and constraining the overall
# complexity of the locking step
# https://docs.astral.sh/uv/reference/settings/#environments
environments = [
  "platform_machine == 'arm64' and sys_platform == 'darwin'",
  "sys_platform == 'linux' and platform_machine == 'x86_64'",
  # we have to add the following to make the right python packages for linux
  # for downstream use in our linux/arm64 docker images.
  # there's subtle differences in the naming convention on the python side
  # even though they are the same architecture, so we use aarch64
  "sys_platform == 'linux' and platform_machine == 'aarch64'",
]

constraint-dependencies = [
  "GitPython>=3.1.58",
  "Mako>=1.3.12",
  "Pygments>=2.20.0",
  "aiohttp>=3.14.1",                               # High/Medium/Low OOS – auditor-tasks + customizer
  "authlib>=1.6.11",
  "black>=26.3.1",
  "bleach>=6.4.0",
  "cryptography>=50.0.0,<51",
  "datamodel-code-generator>=0.71.0",
  "diffusers>=0.38.0",
  "filelock>=3.20.3",
  "jupyter-server>=2.20.0",
  "jupyterlab>=4.6.1",
  "joserfc>=1.7.2",
  "langchain-community>=0.3.31,<0.4",              # 0.4.x removes the vertexai import path used by ragas 0.4.3
  "langchain-core>=1.4.9",
  "langchain-nvidia-ai-endpoints>=1.4.3",
  "langchain-openai>=1.3.5",
  "langgraph>=1.2.6",
  "langsmith>=0.9.7",
  "json-repair>=0.60.1",
  "litellm>=1.83.10",
  "lxml>=6.1.0",
  "mistune>=3.3.2",
  "mcp>=1.28.1",
  "mlflow-skinny>=3.15.0,<3.16.0",
  "msgpack>=1.2.1",
  "nemo-fabric-adapter-contract==0.3.0b1",
  "nemo-fabric-adapters-claude==0.3.0b1",
  "nemo-fabric-adapters-codex==0.3.0b1",
  "nemo-fabric-adapters-common==0.3.0b1",
  "nemo-fabric-adapters-deepagents==0.3.0b1",
  "nemo-fabric-adapters-hermes==0.3.0b1",
  "nemo-fabric-runtime==0.3.0b1",
  "nbconvert>=7.17.1",
  "nltk>=3.10.0",
  "pillow>=12.3.0",
  "postcss>=8.5.10",
  "pyasn1>=0.6.4",
  "pydantic-monty==0.0.18",                        # 0.0.19 dropped MontyRepl required by pydantic-ai-harness==0.3.0 CodeMode
  "python-multipart>=0.0.27",
  "regex>=2025.10.22",
  "safetensors>=0.8.0rc0",                         # explicit prerelease so uv allows the rc
  "sqlfluff>=4.2.2",
  "sqlparse>=0.6.0,<0.7",
  "starlette>=1.3.1",
  "urllib3>=2.7.0",
  "uv>=0.9.14",
  "wandb>=0.29.0",
]

override-dependencies = [
  # unsloth requires a later version but will never be used on macos. mostly useful for dev
  "datasets>=3.3.1, <=4.3.0",
  "jsonpath-ng>=1.6.1",
  "grpcio>=1.71.0",
  "huggingface-hub>=1.0.1,<2.0.0",
  "pydantic[email]>=2.9.2",             # openai-harmony depends on a later pydantic, but that causes the stainless gen to hit an infinite loop
  "ray; sys_platform == 'never'",       # ray has an unfixed critical CVE, as for why we're removing it this way see https://github.com/astral-sh/uv/issues/9174
  "fschat; sys_platform == 'never'",    # fschat is unmaintained with unfixed High/Medium CVEs; transitive via garak but never imported
  "diskcache; sys_platform == 'never'", # unfixed CVE-2025-69872; transitive via ragas but not imported
  "botocore>=1.40.46,<1.40.62",         # ngcsdk requires botocore>=1.37; upper bound required by aiobotocore 2.25.1 (aioboto3 15.5.0)
  # todo(dn-v2): unpin these. this was originally causing tests to fail.
  "aiodns==3.5.0",
  "pycares==4.11.0",
  "authlib>=1.6.9",           # Critical – nmp-api/core/cpu-tasks/gpu-tasks
  "aiohttp>=3.14.1",          # High/Medium/Low OOS – auditor-tasks + customizer
  "jaraco-context>=6.1.0",    # High OOS – auditor-tasks + customizer
  "joserfc>=1.7.2",
  "pyasn1>=0.6.4",            # High OOS – auditor-tasks + customizer
  "setuptools>=78.1.1",       # High OOS – nmp-cpu-tasks/gpu-tasks/customizer-tasks
  "urllib3>=2.7.0",           # High OOS – auditor-tasks + customizer
  "wheel>=0.46.2",            # High OOS – widespread
  "cbor2>=5.9.0",             # High – customizer + nmp-gpu-tasks
  "simpleeval>=1.0.5",        # High – nmp-api + nmp-gpu-tasks
  "ujson>=5.12.0",            # High – nmp-api/cpu-tasks/gpu-tasks
  "xgrammar>=0.1.32",         # High – customizer + nmp-gpu-tasks
  "fastmcp>=3.2.0",           # GHSA-vv7q-7jx5-f767 (Critical) + GHSA-rww4-4w9c-7733 (High); overrides vendored sdk/python/nemo-platform <3 constraint
  "wandb>=0.29.0",            # wandb-core Go CVEs (nspect); optional integrations + training images
  "cryptography>=50.0.0,<51", # GHSA-g6cj-pr64-35w5; overrides nvidia-nat-core's <47 cap after changelog review
  "click>=8.2.0",             # Below CVEs are based on constraints that garak has
  "litellm>=1.83.10",         # CVE-2026-42208 (Critical SQL injection), CVE-2026-40217, and 5 other High CVEs
  "python-dotenv>=1.2.2",
  "openai>=2.26.0",

]

[[tool.uv.index]]
name = "data-designer-plugins"
url = "https://nvidia-nemo.github.io/DataDesignerPlugins/simple/"
explicit = true

[tool.uv.sources]
data-designer-retrieval-sdg = { index = "data-designer-plugins" }
nmp-auth = { workspace = true }
nemo-anonymizer-plugin = { workspace = true }
nemo-iron-swarm-plugin = { workspace = true }
nemo-data-designer-plugin = { workspace = true }
data-designer-nemo = { workspace = true }
nemo-evaluator-sdk = { workspace = true }
sandboxed-gym = { workspace = true }
nmp-guardrails = { workspace = true }
nmp-intake = { workspace = true }
nmp-jobs = { workspace = true }
nmp-models = { workspace = true }
nmp-inference-gateway = { workspace = true }
nmp-files = { workspace = true }
nmp-entities = { workspace = true }
models = { workspace = true }
nemo-platform-sdk = { workspace = true }
nemo-platform = { workspace = true }
nemo-platform-ext = { workspace = true }
acme-strategies = { workspace = true }
nemo-platform-sdk-tools = { workspace = true }
nmp-core-mcp = { workspace = true }
nemo-nb = { workspace = true }
nmp-common = { workspace = true }
garak-api = { workspace = true }
nmp-platform = { workspace = true }
nmp-platform-runner = { workspace = true }
nmp-platform-seed = { workspace = true }
nmp-hello-world = { workspace = true }
nmp-studio = { workspace = true }
nmp-secrets = { workspace = true }
nmp-dev-mcp = { workspace = true }
nmp-testing = { workspace = true }
nmp-build-tools = { workspace = true }
nemo-platform-plugin = { workspace = true }
nemo-insights-plugin = { workspace = true }
nemo-eval-author-plugin = { workspace = true }
nemo-experimentalist-plugin = { workspace = true }

nemo-evaluator-plugin = { workspace = true }
nemo-scaled-evals-plugin = { workspace = true }
nemo-guardrails-plugin = { workspace = true }
nemo-auditor-plugin = { workspace = true }
nemo-safe-synthesizer-plugin = { workspace = true }
nemo-switchyard = { workspace = true }
nemo-agents-plugin = { workspace = true }
nemo-deployments-plugin = { workspace = true }
nemo-agents-example-calculator = { workspace = true }
nemo-agents-example-email-phishing = { workspace = true }
nemo-agents-example-email-security = { workspace = true }
nemo-customizer-plugin = { workspace = true }
nemo-automodel-plugin = { workspace = true }
nemo-optimization-plugin = { workspace = true }
nemo-unsloth-plugin = { workspace = true }
nemo-rl-plugin = { workspace = true }
nmp-automodel = { workspace = true }
nmp-unsloth = { workspace = true }
nmp-rl = { workspace = true }
nmp-customization-common = { workspace = true }


[tool.uv.workspace]
members = [
  "packages/nemo_platform_plugin",
  "packages/nmp_build_tools",
  "packages/nemo_platform",
  "packages/filesets",
  "packages/nmp_common",
  "packages/nmp_customization_common",
  "packages/nmp_platform_runner",
  "packages/garak_api/",
  "packages/nmp_testing",
  "packages/nemo_nb",
  "packages/data_designer_nemo",
  "packages/nmp_platform",
  "packages/sandboxed_gym",
  "services/hello-world",
  "services/studio",
  "services/guardrails",
  "services/intake",
  "plugins/nemo-anonymizer",
  "plugins/nemo-iron-swarm",
  "plugins/nemo-data-designer",
  "services/core/auth",
  "services/platform-seed",
  "services/core/jobs",
  "services/core/entities",
  "services/core/models",
  "services/core/inference-gateway",
  "services/core/files",
  "services/core/secrets",
  "services/core/mcp",
  "tools/nemo-platform-sdk-tools",
  "tools/mcp-dev-tools",
  "packages/nmp_testing",
  # SDK
  "sdk/python/nemo-platform",
  "packages/nemo_platform_ext",
  "packages/nemo_evaluator_sdk",
  "packages/filesets",
  "packages/models",
  "plugins/nemo-guardrails",
  "plugins/nemo-evaluator",
  "plugins/_temporary-scaled-evals",
  "plugins/nemo-auditor",
  "plugins/nemo-safe-synthesizer",
  "plugins/nemo-switchyard",
  "plugins/nemo-agents",
  "plugins/nemo-deployments",
  "plugins/nemo-insights",
  "plugins/nemo-eval-author",
  "plugins/nemo-experimentalist",
  # Not shipped. An out-of-tree component package, installed so the tests that prove the
  # plugin mechanism actually run instead of being skipped by `importorskip`.
  "plugins/nemo-experimentalist/examples/acme-strategies",
  "plugins/nemo-agents/examples/calculator-agent",
  "plugins/nemo-agents/examples/email-phishing-analyzer",
  "plugins/nemo-agents/examples/email-security-analyst",
  "plugins/nemo-agents/examples/nemo-agent-config/calculator-agent",
  "plugins/nemo-customizer",
  "plugins/nemo-automodel",
  "plugins/nemo-optimization",
  "plugins/nemo-unsloth",
  "plugins/nemo-rl",
  "services/automodel",
  "services/unsloth",
  "services/rl",
]


[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["packages/nmp_platform/", "script/"]

# Pytest configuration is now in pytest.ini
# This section is kept for reference but pytest.ini takes precedence
# [tool.pytest.ini_options]
# testpaths = [
#     "tests/integration",
#     "packages/nmp_common/tests",
# ]


[tool.coverage.run]
# Measure branch coverage in addition to statement coverage
branch = true
parallel = true
source = ["packages/", "services/"]
omit = [
  "*/tests/*",
  "*/test_*.py",
  "*/*_test.py",
  "*/__pycache__/*",
  "*/conftest.py",
  "*/.venv/*",
  "*/venv/*",
  "*/.tox/*",
  "*/.flox/*",
  "*/setup.py",
  "*/site-packages/*",
]

[tool.coverage.report]
# Fail if coverage falls below this percentage
fail_under = 0 # Start at 0, increase as tests are added
precision = 2
show_missing = true
skip_covered = false
skip_empty = true
sort = "Cover"
exclude_lines = [
  # Standard exclusions
  "pragma: no cover",
  "def __repr__",
  "def __str__",
  "raise AssertionError",
  "raise NotImplementedError",
  "if __name__ == .__main__.:",
  "if TYPE_CHECKING:",
  # Abstract methods
  "@(abc\\.)?abstractmethod",
  # Defensive programming
  "except ImportError:",
  "except ModuleNotFoundError:",
  # Logging
  "logger\\.",
]
exclude_also = [
  # Exclude files that are auto-generated
  '\A(?s:.*# NOTE: This file is auto-generated.*)\Z',
]

[tool.coverage.html]
directory = "htmlcov"

[tool.coverage.xml]
output = "coverage.xml"

[tool.pyright]
extraPaths = [
  "plugins/nemo-guardrails/src",
  "plugins/nemo-evaluator/src",
  "plugins/nemo-insights/src",
  "tests/agentic-use",
  "tests/agentic-use/shared",
]
executionEnvironments = [
  { root = "tests/agentic-use", extraPaths = [
    "tests/agentic-use",
    "tests/agentic-use/shared",
  ] },
]

[tool.ty.environment]
python-version = "3.12"
extra-paths = [
  # nemo-data-designer plugin is a workspace member; add its src so ty can
  # resolve nemo_data_designer_plugin imports from plugin test files.
  "plugins/nemo-data-designer/src",
  # data-designer-nemo library is a workspace member; add its src so ty can
  # resolve data_designer_nemo imports from library and plugin test files.
  "packages/data_designer_nemo/src",
  # nemo-agents plugin is not a workspace member; add its src so ty can
  # resolve nemo_agents_plugin imports when checking plugin test files.
  "plugins/nemo-agents/src",
  # The built-in NeMo Assistant is a standalone deployable with its own lockfile;
  # add its src so ty can resolve nemo_studio_assistant imports from its tests.
  "agents/nemo-studio-assistant/src",
  # example-plugin is not a workspace member; add its src so ty can
  # resolve nmp.example_plugin imports when checking plugin test files.
  "plugins/example-plugin/src",
  # nemo-guardrails plugin is not a workspace member; add its src so ty can
  # resolve nemo_guardrails_plugin imports when checking plugin test files.
  "plugins/nemo-guardrails/src",
  # So ``integration.*`` and ``from .utils import`` resolve in plugin tests (PEP 420).
  "plugins/nemo-guardrails/tests",
  # So ``_doubles`` (the iron-swarm plugin's shared test stand-ins) resolves in its tests.
  "plugins/nemo-iron-swarm/tests/unit",
  # nemo-evaluator plugin is not a workspace member; add its src so ty can
  # resolve nemo_evaluator imports when checking plugin test files.
  "plugins/nemo-evaluator/src",
  # Source path for the Insights analyst plugin.
  "plugins/nemo-insights/src",
  # Source path for Experimentalist; its tests also import the benchmark runner.
  "plugins/nemo-experimentalist/src",
  # Source path for sandboxed-gym; its tests import the package under test.
  "packages/sandboxed_gym/src",
  # Agentic-use tests place both tests/agentic-use and tests/agentic-use/shared
  # on sys.path in tests/conftest.py.
  "tests/agentic-use",
  "tests/agentic-use/shared",
]

[tool.ty.src]
# Below is a list of excluded directories from ty typechecks.
# Each directory corresponds to a CODEOWNER group who has a shared responsibility
# for the ensuring type safety of the code in that directory.
# No directories should be added to the exclusion group, unless is results in more
# code being typechecked (for example, excluding a set of subdirectories once one of
# their parent has been removed to the exclusion group).
exclude = [
  ".uv_cache", # Cache Dir in CI

  "./script/",

  "packages/nmp_common/",

  # Runtime-only imports absent from a workspace checkout by design. `gym_host_runtime` drives
  # NeMo-Gym from inside the Gym image; the other three use the OpenSandbox SDK, an optional
  # extra. Everything these modules need at *import* time is vendored (`sandboxed_gym.wire`,
  # `sandboxed_gym.sandbox_types`). Same rationale as the GPU training drivers below.
  #
  # The episode driver and backend DO type-check cleanly against the real SDK -- verified with
  # `sandboxed-gym[opensandbox]` installed. They are excluded only because CI installs workspace
  # members without their extras, so `ty` would report `opensandbox` as unresolved. Drop these two
  # lines once the lint job installs that extra.
  "packages/sandboxed_gym/src/sandboxed_gym/backends/_opensandbox_driver.py",
  "packages/sandboxed_gym/src/sandboxed_gym/backends/opensandbox.py",
  "packages/sandboxed_gym/src/sandboxed_gym/host/opensandbox.py",
  "packages/sandboxed_gym/src/sandboxed_gym/ray/",
  "packages/sandboxed_gym/src/sandboxed_gym/runtime/gym_host_runtime.py",

  "packages/nemo_platform_ext/",
  "packages/nemo_nb/",

  "packages/nemo_platform_plugin/src/nemo_platform_plugin/jobs/api_factory.py",

  "packages/garak_api/",

  # GPU-container training drivers import torch/peft/nemo_automodel/unsloth/nemo_rl at runtime only.
  "services/automodel/src/nmp/automodel/tasks/training/backends/",
  "services/automodel/src/nmp/automodel/tasks/training/utils.py",
  "services/automodel/src/nmp/automodel/tasks/retrieval_mine/mine_hard_negatives.py",
  "services/unsloth/src/nmp/unsloth/tasks/training/backends/",
  "services/rl/src/nmp/rl/tasks/training/backends/",
  "services/rl/src/nmp/rl/tasks/training/utils.py",
  "services/rl/src/nmp/rl/tasks/training/runner.py",
  # Helm chart test payloads run inside purpose-built Kubernetes containers.
  # The NCCL worker imports torch at runtime, which is not part of the root
  # workspace type-checking environment.
  "k8s/helm/files/nccl-test/",

  "./services/guardrails/",

  "./services/intake/",

  "./services/core/",

  "./services/jailbreak-detect/",

  "./tests/",

  # Installed in the normal workspace graph now, but still has standalone `ty`
  # diagnostics against strict Switchyard and test typings. Keep excluded from
  # root `ty` until that cleanup lands in a focused follow-up.
  "plugins/nemo-switchyard/",

  # Standalone agents-under-test: each resolves from its own lockfile inside the
  # benchmark's task containers, so its imports are absent from the workspace env.
  "plugins/nemo-experimentalist/examples/",

  # Source injected into the evaluation harness image at build time, where it
  # replaces modules of the sandbox library it imports. Nothing imports it from
  # the control plane, so that library is absent from the workspace env.
  "plugins/_temporary-scaled-evals/harbor-patches/",

  "docs/",

  "./sdk/",

  "tools/nemo-platform-sdk-tools/src/nemo_platform_sdk_tools/sdk",
  "tools/nemo-platform-sdk-tools/tests/sdk",
]

# nooa agents declare their LLM-generated methods as annotated signatures with an
# ellipsis body; the framework fills them in at runtime. ty reads that as a missing
# return, so the rule is off for the Experimentalist agent classes only.
[[tool.ty.overrides]]
include = ["plugins/nemo-experimentalist/src/**"]

[tool.ty.overrides.rules]
empty-body = "ignore"

# TEMPORARY — remove together with the fix in #1237, which is where this file is
# already corrected.
#
# A stored task's content moved under a discriminated `spec`, so this example's
# `TaskInput(intent=..., inputs=..., metrics=...)` no longer type-checks. The fix is
# written and sitting in #1237; it cannot ride along here because editing any file under
# `skills/` puts the PR behind the NVSkills gate, and that gate currently cannot pass —
# tier 3 runs with `--env-mode local`, whose bubblewrap sandbox fails its smoke test on
# the nvcarps runners, so nothing is evaluated and it blocks on empty coverage.
#
# Scoped to the one file and the two rules the stale call produces, rather than added to
# `[tool.ty.src].exclude`, so everything else in the file stays type-checked and this
# expires loudly rather than quietly widening.
[[tool.ty.overrides]]
include = [
  "skills/nemo-evaluator-plugin/assets/examples/plugin_sdk_examples.py",
]

[tool.ty.overrides.rules]
missing-argument = "ignore"
unknown-argument = "ignore"