pyproject.toml

[project]
name = "godspeed-coding-agent"
version = "0.5.0"
description = "Security-first open-source coding agent with parallel tool execution, multimodal input, 4-tier permissions, audit trails, and 200+ LLM provider support"
readme = "README.md"
license = "MIT"
requires-python = ">=3.11"
authors = [
    { name = "Tremayne Timms", email = "Ttimmsinternational@gmail.com" },
]
keywords = [
    "ai",
    "coding-agent",
    "llm",
    "security",
    "audit-trail",
    "cli",
    "developer-tools",
    "open-source",
    "litellm",
    "multi-agent",
]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Environment :: Console",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Software Development",
    "Topic :: Software Development :: Libraries :: Application Frameworks",
    "Typing :: Typed",
]
dependencies = [
    # litellm < 1.84.0 has CVE-2026-49468 (auth bypass via Host header injection).
    # Cap < 1.92: 1.92.0 adds a Rust extension with no Windows wheel (maturin
    # source build fails); 1.91.3 is the last pure-Python release.
    "litellm>=1.84.0,<1.92",
    "pydantic>=2.12.5,<3.0",
    "pydantic-settings>=2.14.2,<3.0",
    "click>=8.1.0,<9.0",
    "rich>=15.0.0,<16.0",
    "prompt-toolkit>=3.0.52,<4.0",
    "textual>=2.0.0,<9.0",
    "tiktoken>=0.9.0,<1.0",
    "gitpython>=3.1.50,<4.0",
    "diff-match-patch>=20241021",
    "pyyaml>=6.0.3,<7.0",
    # System introspection for SystemOptimizerTool (inspect/recommend modes).
    # Cross-platform; ~800KB. Lighter than keeping it as an optional extra
    # because the tool is registered by default and CI needs it to test.
    "psutil>=7.2.2,<8.0",
    # Transitive pin-up: aiohttp is pulled in via litellm; versions < 3.14.1
    # carry known CVEs (request-smuggling / parser series).
    "aiohttp>=3.14.1",
    # urllib3 decompression-bomb CVE in streaming API. Bump past affected versions.
    "urllib3>=2.6.4",
    # python-dotenv CVE-2026-28684 is known (fix in 1.2.2) but litellm pins
    # python-dotenv==1.0.1 strictly, making a pin-up unsatisfiable. CI's
    # pip-audit call suppresses this one CVE via --ignore-vuln below. We'll
    # remove the suppression when litellm relaxes its bound.
    "yfinance>=1.3.0",
    "readability-lxml>=0.8.4.1",
    # Transitive pin-up: lxml-html-clean is pulled in via readability-lxml;
    # < 0.4.5 has PYSEC-2026-2614.
    "lxml-html-clean>=0.4.5",
    "mcp>=1.28.1,<2.0",
    # python-multipart < 0.0.31 has DoS CVEs in multipart boundary parsing.
    "python-multipart>=0.0.31,<0.1",
    "datasets>=4.8.5",
    "pywinpty>=3.0.3; sys_platform == 'win32'",
    "textual-serve>=1.1.3",
]

[project.optional-dependencies]
dev = [
    "pytest>=9.0.3,<10.0",
    "pytest-cov>=7.1.0,<8.0",
    "pytest-asyncio>=1.3.0,<2.0",
    "ruff>=0.15.12,<1.0",
    "mypy>=1.20.2,<3.0",
    "types-PyYAML>=6.0.12.20260408,<7.0",
    "hypothesis>=6.152.2,<7.0",
    "pre-commit>=4.6.0,<5.0",
    "pip-audit>=2.10.0,<3.0",
    "bandit>=1.7.0,<2.0",
]
context = [
    "tree-sitter>=0.25.2,<1.0",
    "tree-sitter-language-pack>=0.5.0,<2.0",
    "grep-ast>=0.9.0,<1.0",
]
mcp = []
index = [
    "chromadb>=1.5.8,<2.0",
]

[project.scripts]
godspeed = "godspeed.cli:main"
godspeed-lite = "godspeed.lite.cli:main"

[project.urls]
Homepage = "https://github.com/t-timms/godspeed-coding-agent"
Repository = "https://github.com/t-timms/godspeed-coding-agent"
Issues = "https://github.com/t-timms/godspeed-coding-agent/issues"
Documentation = "https://github.com/t-timms/godspeed-coding-agent#readme"
Changelog = "https://github.com/t-timms/godspeed-coding-agent/blob/main/CHANGELOG.md"

[build-system]
requires = ["hatchling>=1.26.0"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/godspeed"]

[tool.ruff]
line-length = 100
target-version = "py311"
extend-exclude = [
    "benchmarks/fixtures/easy-fix-syntax-01/app.py",  # intentional syntax error
    "benchmarks/",
]

[tool.ruff.lint]
select = [
    "E",    # pycodestyle errors
    "W",    # pycodestyle warnings
    "F",    # pyflakes
    "I",    # isort
    "N",    # pep8-naming
    "UP",   # pyupgrade
    "B",    # flake8-bugbear
    "SIM",  # flake8-simplify
    "RUF",  # ruff-specific
    "S",    # flake8-bandit
    "T20",  # flake8-print
    "FA",   # flake8-future-annotations
    "ARG",  # flake8-unused-arguments
    "BLE",  # flake8-blind-except
    "RET",  # flake8-return
]
ignore = ["S603", "S607"]  # subprocess calls are intentional for a coding agent

[tool.ruff.lint.per-file-ignores]
"tests/**/*.py" = ["S101", "S102", "S105", "S106", "S108", "SIM117", "SIM221", "SIM105", "ARG001", "ARG002", "ARG004", "ARG005", "BLE001", "RET504", "F841", "F811", "F821", "S110", "S608", "RUF059", "RUF100", "RUF012", "RUF015", "SLF001", "E501", "E721", "E731", "E741", "B017", "B018", "I001", "N802", "N806"]  # test resilience patterns
"src/godspeed/security/secrets.py" = ["S106"]  # secret_type= is a label, not a password
"scripts/**/*.py" = ["T201", "ARG001", "ARG002", "BLE001", "RET505"]  # CLI scripts: print, args, exceptions, elif patterns
"experiments/**/*.py" = ["S311", "N818", "SIM103"]  # jitter/naming/style nits in research code
"experiments/**/tests/**/*.py" = ["S101", "S105", "S106", "SLF001", "S311", "N818", "SIM103"]
"src/godspeed/tools/**/*.py" = ["BLE001", "ARG001", "ARG002", "SIM102", "RET505"]  # tools: ABC signatures, broad exceptions, elif patterns
"src/godspeed/llm/client.py" = ["BLE001", "RET504"]  # LLM client: broad exceptions for fallback chains; returns for clarity
"src/godspeed/mcp/**/*.py" = ["BLE001", "ARG002"]  # MCP client: broad exceptions for transport failures; interface contracts
"src/godspeed/agent/**/*.py" = ["ARG002", "BLE001", "RET504"]  # agent loop patterns: broad except boundaries, ABC signatures
"src/godspeed/context/**/*.py" = ["BLE001", "ARG004"]  # defensive exception handling; optional args
"src/godspeed/evaluation/**/*.py" = ["BLE001"]  # defensive test evaluation
"src/godspeed/evolution/**/*.py" = ["ARG004", "RET504", "BLE001"]  # code generation patterns, defensive errors
"src/godspeed/hooks/**/*.py" = ["ARG002"]  # hook interface contracts
"src/godspeed/observability/**/*.py" = ["ARG002"]  # metrics interface
"src/godspeed/skills/commands.py" = ["ARG001", "RET505"]  # optional params; elif patterns
"src/godspeed/skills/wiki_bridge.py" = ["BLE001"]  # defensive parsing
"src/godspeed/training/**/*.py" = ["BLE001", "ARG001"]  # training data resilience
"src/godspeed/audit/**/*.py" = ["ARG002"]  # future output format
"scripts/serve_zaya1.py" = ["E501"]  # long command-line strings
"src/godspeed/tui/**/*.py" = ["BLE001"]  # TUI catches broad exceptions for UI resilience
"src/godspeed/cli.py" = ["BLE001"]  # CLI catches broad exceptions to prevent crashes
"src/godspeed/agent/loop.py" = ["BLE001", "ARG001", "ARG002"]  # agent loop callbacks have fixed signatures
"src/godspeed/context/codebase_index.py" = ["BLE001"]  # ChromaDB integration; broad exception handling
"src/godspeed/context/coherence_graph.py" = ["BLE001"]  # graph operations; broad exception handling
"src/godspeed/context/lsp.py" = ["BLE001"]  # LSP subprocess I/O catches broad exceptions
"src/godspeed/evaluation/swebench_harness.py" = ["BLE001"]  # agent run loop catches broad exceptions
"benchmarks/fixtures/**/*.py" = [
    "T201",  # print() is intentional in diagnostic scripts
    "S603", "S607", "S102",  # subprocess is intentional in setup/verify hooks
    "S101", "S105", "S108",  # fixture files simulate vulnerable code the agent must fix
    "S113", "S608",
    "E501",
]
"experiments/swebench_lite/**/*.py" = ["T201", "E501"]  # CLI scripts with long log lines

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"
markers = [
    "real_llm: requires a running Ollama server on localhost:11434 (skipped by default)",
    "real_db: requires SQLite/file system access for live database tests (skipped by default in CI)",
    "real_git: requires git installed for live git/GitHub tests (skipped by default in CI)",
]
addopts = "-m 'not real_llm and not real_db and not real_git'"

[tool.mypy]
ignore_missing_imports = true
warn_unused_ignores = true

[[tool.mypy.overrides]]
module = ["chromadb", "psutil"]
ignore_missing_imports = true

[tool.coverage.run]
source = ["src/godspeed"]
branch = true
omit = [
    "src/godspeed/tui/*",
    "src/godspeed/lite/*",
    "src/godspeed/benchmarks/*",
]

[tool.coverage.report]
show_missing = true
fail_under = 85

[dependency-groups]
dev = [
    "bandit>=1.9.4",
    "pip-audit>=2.10.0",
    "pytest>=9.0.3",
    "pytest-asyncio>=1.3.0",
    "pytest-cov>=7.1.0",
    "pytest-mock>=3.15.1",
    "types-pyyaml>=6.0.12.20260408",
    "vulture>=2.16",
]