pyproject.toml

[project]
name = "rogue-ai"
dynamic = ["version"]
description = "Rogue agent evaluator by Rogue Security"
readme = "README.md"
requires-python = ">=3.10"
dependencies = [
    "a2a-sdk==0.2.10",
    "backoff>=2.2.1",
    "boto3>=1.40.69",
    "click>=8.0.0",
    "datasets==3.6.0",
    "fastapi>=0.121.0",
    "fastmcp>=2.12.5",
    "google-adk==1.23.0",
    "langchain-openai>=0.3.35",
    "litellm==1.76.1",
    "loguru==0.7.3",
    "platformdirs>=4.3.8",
    "psutil>=7.0.0",
    "pydantic==2.11.7",
    "pydantic-yaml==1.5.1",
    "python-dotenv==1.1.1",
    "requests>=2.32.4",
    "rich>=14.0.0",
    "rogue-ai-sdk>=0.1.3",
    "tomli>=2.0.1; python_version < '3.11'",
    "tomli-w>=1.0.0",
    "uvicorn>=0.38.0",
]

[dependency-groups]
dev = [
    # ruff replaces black + flake8 + isort + bandit + add-trailing-comma; ty
    # replaces mypy. Both are written in Rust by Astral and are 10–100x faster
    # than the toolchain they superseded.
    "ruff>=0.7.0",
    "ty>=0.0.1a1",
    "pytest>=8.4.1",
    "pytest-asyncio>=0.24.0",
    "pytest-cov>=6.2.1",
    "pytest-mock>=3.14.1",
    "types-requests>=2.32.4.20250611",
    "pre-commit>=4.3.0",
]
examples = [
    "langchain>=0.3.27",
    "langchain-core>=1.0.0",
    "langchain-openai>=1.0.0",
    "langgraph>=0.6.10",
    "mcp[cli]>=1.13.0",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.version]
path = "VERSION"
pattern = "(?P<version>^\\s*[^\\r\\n\\s]+)"

[tool.hatch.build.targets.wheel]
packages = ["rogue", "examples"]

[tool.hatch.build.targets.wheel.sources]
"rogue" = "rogue"
"examples" = "examples"

[tool.hatch.build.targets.sdist]
include = [
    "rogue/**",
    "examples/**",
    "VERSION",
    "README.md",
    "hatch_build.py",
]

# Note: the web SPA dist is force-included dynamically via hatch_build.py only
# when packages/web/dist exists, so installs (e.g. `uv pip install -e .`) don't
# fail in environments that don't have pnpm and don't need the bundled UI.

[tool.hatch.build.hooks.custom]
path = "hatch_build.py"

[tool.uv.sources]
rogue-ai-sdk = { path = "sdks/python", editable = true }

[project.scripts]
rogue-ai = "rogue.__main__:main"
rogue-ai-example-tshirt = "examples.tshirt_store_agent.__main__:main"

# ─── Ruff ─────────────────────────────────────────────────────────────────────
# Mirrors the previous tooling 1:1 — black formatting, flake8 lint, isort
# imports, bandit security — all in a single Rust binary. Rules selected match
# what the prior pipeline enforced; nothing new piles on existing code.

[tool.ruff]
line-length = 88
target-version = "py310"
extend-exclude = [
    ".venv",
    "packages",        # JS workspace, not Python
]
# Apply the exclude list even when files are passed explicitly (e.g. by
# lefthook's `{staged_files}`). Without this, lefthook would re-introduce
# every issue we deliberately ignore at the project level.
force-exclude = true

[tool.ruff.lint]
# E/W = pycodestyle, F = pyflakes (flake8 default trio)
# I    = isort (replaces standalone isort --profile black)
# S    = flake8-bandit (replaces standalone bandit)
# COM  = flake8-commas (replaces add-trailing-comma)
select = ["E", "F", "W", "I", "S", "COM"]
# - E712 / E203: previously suppressed by .flake8.
# - E501 (line-length): the formatter owns wrap decisions; flagging the
#   leftover string-literal cases creates noise without action.
# - COM812 / COM819: conflict with the formatter's comma handling.
# - S607 (start-process-with-partial-path): we *are* a CLI tool that
#   intentionally invokes `uv`, `uvx`, `osascript`, `powershell`, etc.
#   from PATH. Flagging every one is noise.
ignore = ["E712", "E203", "E501", "COM812", "COM819", "S607"]

[tool.ruff.lint.per-file-ignores]
# Tests routinely use `assert`, fixture imports, etc. — bandit complained
# about all of these via the prior `exclude_dirs: tests` in .bandit.yaml.
"tests/**" = ["S101", "S105", "S106", "S108"]
"**/test_*.py" = ["S101", "S105", "S106", "S108"]
"**/conftest.py" = ["S101"]
# Examples are illustrative, not production.
"examples/**" = ["S101", "S105", "S106", "S603", "S607"]
# Re-export-only `__init__.py` files trip `F401` (unused import) and
# `E402` (re-imports below module-level filterwarnings calls). Drop those
# but keep the rest of the rule set.
"**/__init__.py" = ["F401", "E402"]
# The SDK package's `__init__.py` re-exports via star — that's the
# documented pattern for the public type module. Drop F403/F405 for it.
"sdks/python/rogue_sdk/__init__.py" = ["F401", "E402", "F403", "F405"]

[tool.ruff.lint.isort]
known-first-party = ["rogue", "rogue_sdk", "examples"]
combine-as-imports = true

[tool.ruff.format]
quote-style = "double"
indent-style = "space"
skip-magic-trailing-comma = false
line-ending = "lf"

# ─── ty ───────────────────────────────────────────────────────────────────────
# Astral's static type checker. Replaces mypy. ty is currently pre-release and
# meaningfully stricter than mypy on identical code (especially around Pydantic
# **kwargs unpacking, websockets' dynamic API, and Optional refinement).
#
# Migration policy: keep parity with what mypy was catching. Tests are excluded
# (mypy already ignored them in practice) and the noisy strictness categories
# are downgraded to `warn` so this migration doesn't gate the build on
# pre-existing patterns. Tighten back to `error` once those classes are
# cleaned up incrementally.

[tool.ty.src]
include = ["rogue", "sdks/python", "hatch_build.py"]
exclude = [
    ".venv",
    "node_modules",
    "packages",
    "examples",
    "**/tests/**",
    "**/test_*.py",
    "**/conftest.py",
]

[tool.ty.environment]
python-version = "3.10"

[tool.ty.rules]
# Old `.mypy.ini` had `ignore_missing_imports = True`.
unresolved-import = "ignore"
# All other rules at default `error` severity now that the codebase passes
# clean. The categories listed below were temporarily demoted to `warn`
# during the mypy → ty migration; once cleared they were promoted back so
# regressions fail CI instead of accumulating silently.