pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "secfoo"
dynamic = ["version"]
description = "Context-based security architectural assessment orchestrator: pick skills, targets, and an agent CLI to run them."
readme = "README.md"
requires-python = ">=3.10"
license = "MIT"
license-files = ["LICENSE"]
authors = [
  { name = "RakFort", email = "info@rakfort.com" },
]
keywords = ["security", "threat-modeling", "owasp", "stride", "llm-agent", "compliance"]
classifiers = [
  "Development Status :: 3 - Alpha",
  "Environment :: Console",
  "Intended Audience :: Developers",
  "Programming Language :: Python :: 3",
  "Programming Language :: Python :: 3 :: Only",
  "Topic :: Security",
  "Topic :: Software Development :: Quality Assurance",
]
dependencies = [
  # typer>=0.12 alone still resolves/keeps typer 0.12.3 on an environment
  # that already has it (e.g. an old venv, or a resolver picking the
  # floor) -- confirmed by hitting a real one: typer 0.12.3 + click 8.5.0
  # broke multi-word option parsing ("secfoo accept create --threat-id T1
  # ..." rejected as unexpected extra arguments). typer>=0.15 is the
  # actual minimum verified working against the click pin below.
  "typer>=0.15",
  # click 8.3.3+ fixes PYSEC-2026-2132 (click.edit command injection).
  "click>=8.3.3,<9",
  "rich>=13.0",
  "fastapi>=0.110",
  "uvicorn[standard]>=0.29",
  "jinja2>=3.1",
  "markdown-it-py>=3.0",
  "python-multipart>=0.0.9",
  "tomli>=2.0; python_version < '3.11'",
  # Pure-Python text extraction for uploaded third-party vendor documents
  # (docext.py) -- deliberately no system-level binaries (no poppler, no
  # LibreOffice) so the Docker/Kubernetes image stays lean and doesn't
  # need extra OS packages installed.
  "pypdf>=4.0",
  "python-docx>=1.1",
  "python-pptx>=0.6.23",
  "langgraph>=0.2",
  "litellm>=1.40",
]

[project.optional-dependencies]
dev = ["jsonschema>=4.0", "pytest>=8.0", "hypothesis>=6.100", "httpx>=0.27", "ruff>=0.4", "bandit>=1.8", "pip-audit>=2.7", "langgraph>=0.2"]
build = ["pyinstaller>=6.0"]
# The `api` agent (secfoo/agents/api.py): a LangGraph workflow that calls OpenAI/Anthropic/Gemini
# through LiteLLM with an API key instead of driving an installed agent CLI.
# (dev includes langgraph so the real graph runs in tests; litellm is faked.)
api = ["litellm>=1.40", "langgraph>=0.2"]

[project.scripts]
secfoo = "secfoo.cli:main"

[tool.hatch.version]
# Single source of truth for the version -- pyproject.toml reads it from
# here instead of duplicating it, so a version bump can't happen in one
# place and not the other (exactly the bug that shipped 0.1.1 with
# secfoo.__version__ still reporting "0.1.0").
path = "src/secfoo/__about__.py"

[tool.hatch.build.targets.sdist]
# `only-include` (not `include`, which is additive on top of hatchling's
# default "everything in the project root" selection -- confirmed the hard
# way when `include` alone still let an unrelated cloned repo leak into a
# published release) is the actual strict allowlist: nothing outside these
# paths ships, full stop, regardless of what else lands in the project root.
only-include = [
  "src/secfoo",
  "README.md",
  "LICENSE",
]

[tool.hatch.build.targets.wheel]
packages = ["src/secfoo"]

[tool.pytest.ini_options]
testpaths = ["tests"]