fix(deps): require litellm>=1.93.0 for Python 3.14 support

.github/workflows/test.yml

@@ -286,6 +286,18 @@ jobs:
       working-directory: ./hindsight-api-slim
       run: uv build
 
+    # `uv build` only packages the source; it does not prove the dependency set
+    # resolves or that the code imports on this interpreter. Install into a fresh
+    # env and run a byte-compile + import smoke test so the matrix actually
+    # exercises each Python version (notably 3.14).
+    - name: Install and smoke-test on Python ${{ matrix.python-version }}
+      working-directory: ./hindsight-api-slim
+      run: |
+        uv venv --python ${{ matrix.python-version }} .venv-smoke
+        VIRTUAL_ENV=.venv-smoke uv pip install .
+        .venv-smoke/bin/python -m compileall -q hindsight_api
+        .venv-smoke/bin/python -c "import hindsight_api, hindsight_api.main, hindsight_api.config; from hindsight_api.engine import memory_engine, llm_wrapper; print('import OK')"
+
   build-typescript-client:
     needs: [detect-changes]
     if: >-

hindsight-api-slim/pyproject.toml

@@ -54,7 +54,15 @@ dependencies = [
     "anthropic>=0.40.0",
     "typer>=0.9.0",
     "cohere>=5.0.0",
-    "litellm>=1.84.0", # 1.82.7/1.82.8 had a supply chain compromise (yanked); 1.83.0+ also fixes GHSA-jjhc-v7c2-5hh6 / GHSA-53mr-6c8q-9789 / GHSA-pq44-5pcq-4r5g / GHSA-8cjq-wjmh-q42r; 1.84.0 fixes GHSA-4xpc-pv4p-pm3w
+    # 1.82.7/1.82.8 had a supply chain compromise (yanked); 1.83.0+ also fixes
+    # GHSA-jjhc-v7c2-5hh6 / GHSA-53mr-6c8q-9789 / GHSA-pq44-5pcq-4r5g /
+    # GHSA-8cjq-wjmh-q42r; 1.84.0 fixes GHSA-4xpc-pv4p-pm3w.
+    # Floor raised to 1.93.0 for Python 3.14: litellm ships its own Rust
+    # extension (litellm-rust python-bridge). Releases before 1.93.0 publish no
+    # cp314 wheel and their sdist fails to build because PyO3 0.23.5 rejects
+    # any interpreter newer than 3.13. 1.93.0 adds cp314 wheels and a PyO3 that
+    # builds on 3.14.
+    "litellm>=1.93.0",
     "markitdown[pdf,docx,pptx,xlsx,xls]>=0.1.4", # File to markdown conversion
     "obstore>=0.4.0", # S3/GCS/Azure object storage client (Rust-backed)
     "winloop>=0.1.0; sys_platform == 'win32'",

hindsight-integrations/claude-code/scripts/lib/daemon.py

@@ -42,21 +42,12 @@ def _get_embed_command(config: dict) -> list:
     return ["uvx", package]
 
 
-def _set_uvx_python_compat(cmd: list, env: dict) -> None:
-    """Use a Python version compatible with uvx-managed Hindsight packages."""
-    if cmd and cmd[0] == "uvx" and not env.get("UV_PYTHON", "").strip():
-        # Current LiteLLM/PyO3 resolution cannot build on Python 3.14. Setting
-        # the outer uvx environment also reaches the nested hindsight-api uvx.
-        env["UV_PYTHON"] = "3.13"
-
-
 def _run_embed(config: dict, args: list, env: dict = None, timeout: int = 10) -> subprocess.CompletedProcess:
     """Run a hindsight-embed command and return the result."""
     cmd = _get_embed_command(config) + args
     run_env = dict(os.environ)
     if env:
         run_env.update(env)
-    _set_uvx_python_compat(cmd, run_env)
     return subprocess.run(
         cmd,
         capture_output=True,
@@ -293,7 +284,6 @@ def prestart_daemon_background(config: dict, debug_fn=None):
     embed_cmd = _get_embed_command(config)
     daemon_env = dict(os.environ)
     daemon_env.update(llm_env)
-    _set_uvx_python_compat(embed_cmd, daemon_env)
     idle_timeout = config.get("daemonIdleTimeout", 300)
     daemon_env["HINDSIGHT_EMBED_DAEMON_IDLE_TIMEOUT"] = str(idle_timeout)
     if platform.system() == "Darwin":

hindsight-integrations/codex/scripts/lib/daemon.py

@@ -34,21 +34,12 @@ def _get_embed_command(config: dict) -> list:
     return ["uvx", package]
 
 
-def _set_uvx_python_compat(cmd: list, env: dict) -> None:
-    """Use a Python version compatible with uvx-managed Hindsight packages."""
-    if cmd and cmd[0] == "uvx" and not env.get("UV_PYTHON", "").strip():
-        # Current LiteLLM/PyO3 resolution cannot build on Python 3.14. Setting
-        # the outer uvx environment also reaches the nested hindsight-api uvx.
-        env["UV_PYTHON"] = "3.13"
-
-
 def _run_embed(config: dict, args: list, env: dict = None, timeout: int = 10) -> subprocess.CompletedProcess:
     """Run a hindsight-embed command and return the result."""
     cmd = _get_embed_command(config) + args
     run_env = dict(os.environ)
     if env:
         run_env.update(env)
-    _set_uvx_python_compat(cmd, run_env)
     return subprocess.run(
         cmd,
         capture_output=True,
@@ -265,7 +256,6 @@ def prestart_daemon_background(config: dict, debug_fn=None):
     embed_cmd = _get_embed_command(config)
     daemon_env = dict(os.environ)
     daemon_env.update(llm_env)
-    _set_uvx_python_compat(embed_cmd, daemon_env)
     idle_timeout = config.get("daemonIdleTimeout", 300)
     daemon_env["HINDSIGHT_EMBED_DAEMON_IDLE_TIMEOUT"] = str(idle_timeout)
     if platform.system() == "Darwin":

hindsight-integrations/cursor-cli/hindsight_cursor_cli/hooks/scripts/lib/daemon.py

@@ -37,21 +37,12 @@ def _get_embed_command(config):
     return ["uvx", package]
 
 
-def _set_uvx_python_compat(cmd, env):
-    """Use a Python version compatible with uvx-managed Hindsight packages."""
-    if cmd and cmd[0] == "uvx" and not env.get("UV_PYTHON", "").strip():
-        # Current LiteLLM/PyO3 resolution cannot build on Python 3.14. Setting
-        # the outer uvx environment also reaches the nested hindsight-api uvx.
-        env["UV_PYTHON"] = "3.13"
-
-
 def _run_embed(config, args, env=None, timeout=10):
     """Run a hindsight-embed command and return the result."""
     cmd = _get_embed_command(config) + args
     run_env = dict(os.environ)
     if env:
         run_env.update(env)
-    _set_uvx_python_compat(cmd, run_env)
     return subprocess.run(
         cmd,
         capture_output=True,
@@ -253,7 +244,6 @@ def prestart_daemon_background(config, debug_fn=None):
     embed_cmd = _get_embed_command(config)
     daemon_env = dict(os.environ)
     daemon_env.update(llm_env)
-    _set_uvx_python_compat(embed_cmd, daemon_env)
     idle_timeout = config.get("daemonIdleTimeout", 0)
     daemon_env["HINDSIGHT_EMBED_DAEMON_IDLE_TIMEOUT"] = str(idle_timeout)
     if platform.system() == "Darwin":

hindsight-integrations/cursor/scripts/lib/daemon.py

@@ -32,21 +32,12 @@ def _get_embed_command(config: dict) -> list:
     return ["uvx", package]
 
 
-def _set_uvx_python_compat(cmd: list, env: dict) -> None:
-    """Use a Python version compatible with uvx-managed Hindsight packages."""
-    if cmd and cmd[0] == "uvx" and not env.get("UV_PYTHON", "").strip():
-        # Current LiteLLM/PyO3 resolution cannot build on Python 3.14. Setting
-        # the outer uvx environment also reaches the nested hindsight-api uvx.
-        env["UV_PYTHON"] = "3.13"
-
-
 def _run_embed(config: dict, args: list, env: dict = None, timeout: int = 10) -> subprocess.CompletedProcess:
     """Run a hindsight-embed command and return the result."""
     cmd = _get_embed_command(config) + args
     run_env = dict(os.environ)
     if env:
         run_env.update(env)
-    _set_uvx_python_compat(cmd, run_env)
     return subprocess.run(
         cmd,
         capture_output=True,

hindsight-integrations/cursor/tests/test_daemon.py

@@ -9,37 +9,10 @@
 
 from unittest.mock import patch
 
-from lib import daemon
 from lib.config import DEFAULT_HINDSIGHT_API_URL
 from lib.daemon import get_api_url
 
 
-def test_uvx_defaults_to_python_313(monkeypatch):
-    monkeypatch.delenv("UV_PYTHON", raising=False)
-    with patch("lib.daemon.subprocess.run") as run:
-        daemon._run_embed({}, ["status"])
-    assert run.call_args.kwargs["env"]["UV_PYTHON"] == "3.13"
-
-
-def test_uvx_preserves_explicit_python_override(monkeypatch):
-    with patch("lib.daemon.subprocess.run") as run:
-        daemon._run_embed({}, ["status"], env={"UV_PYTHON": "3.12"})
-    assert run.call_args.kwargs["env"]["UV_PYTHON"] == "3.12"
-
-
-def test_uvx_replaces_blank_python_override(monkeypatch):
-    with patch("lib.daemon.subprocess.run") as run:
-        daemon._run_embed({}, ["status"], env={"UV_PYTHON": "  "})
-    assert run.call_args.kwargs["env"]["UV_PYTHON"] == "3.13"
-
-
-def test_development_embed_does_not_pin_python(monkeypatch):
-    monkeypatch.delenv("UV_PYTHON", raising=False)
-    with patch("lib.daemon.subprocess.run") as run:
-        daemon._run_embed({"embedPackagePath": "/tmp/hindsight-embed"}, ["status"])
-    assert "UV_PYTHON" not in run.call_args.kwargs["env"]
-
-
 class TestGetApiUrlResolution:
     def test_explicit_url_wins(self):
         config = {"hindsightApiUrl": "http://my-server:9000", "apiPort": 9077}

hindsight-integrations/litellm/pyproject.toml

@@ -34,7 +34,12 @@ classifiers = [
 
 dependencies = [
     "hindsight-client>=0.4.0",  # provides both hindsight_client and hindsight_client_api
-    "litellm>=1.84.0", # 1.82.7/1.82.8 supply-chain fix plus GHSA-jjhc-v7c2-5hh6 / GHSA-53mr-6c8q-9789 / GHSA-qrc4-49gv-mv9m / GHSA-wpfp-gwwc-vwq6 / GHSA-4xpc-pv4p-pm3w
+    # 1.82.7/1.82.8 supply-chain fix plus GHSA-jjhc-v7c2-5hh6 /
+    # GHSA-53mr-6c8q-9789 / GHSA-qrc4-49gv-mv9m / GHSA-wpfp-gwwc-vwq6 /
+    # GHSA-4xpc-pv4p-pm3w. Floor raised to 1.93.0 for Python 3.14: earlier
+    # releases publish no cp314 wheel and their bundled Rust extension fails to
+    # build (PyO3 0.23.5 supports 3.13 at most).
+    "litellm>=1.93.0",
     # Transitive dependency security fixes
     "aiohttp>=3.13.3",  # Multiple DoS vulnerabilities
     "filelock>=3.20.3",  # TOCTOU race condition