pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "virtual-patch-copilot"
version = "0.3.0"
description = "Agent pipeline that finds vulnerabilities, triages each to the right F5 Distributed Cloud control (or to code), generates the virtual patch, and drafts the real code fix. Model-independent."
readme = "README.md"
requires-python = ">=3.10"
license = "Apache-2.0"
license-files = ["LICENSE"]
authors = [{ name = "virtual-patch-copilot contributors" }]
keywords = ["security", "appsec", "waf", "f5", "distributed-cloud", "virtual-patching", "llm", "agents"]
classifiers = [
  "Development Status :: 4 - Beta",
  "Intended Audience :: Developers",
  "Topic :: Security",
  "Programming Language :: Python :: 3 :: Only",
]
dependencies = [
  "litellm>=1.40",      # transport: one interface to Anthropic/OpenAI/Gemini/Ollama/...
  "instructor>=1.3",    # structured output (JSON Schema + validate/repair) across providers
  "pydantic>=2.6",      # typed agent I/O
  "pyyaml>=6.0",        # config/agents.yaml
  "typer>=0.12",        # CLI
  "rich>=13.0",         # pretty CLI output
  "python-dotenv>=1.0", # load .env
  "httpx>=0.27",        # XC config API client + validation prober
]

[project.optional-dependencies]
# Pulled in for the remediation-PR increment.
deploy = ["PyGithub>=2.3"]
# Ops console (localhost web UI).
console = ["fastapi>=0.110", "uvicorn>=0.29"]
# `jsonschema` validates the L1 emitter's output against the vendored BIG-IP / NGINX App Protect
# schemas. It was already present transitively via litellm; declared here so the L1 test cannot be
# broken by an unrelated dependency bump.
dev = ["pytest>=8.0", "pytest-cov>=5.0", "ruff>=0.5", "jsonschema>=4.0"]

[project.urls]
Homepage = "https://github.com/henleda/virtual-patch-copilot"
Repository = "https://github.com/henleda/virtual-patch-copilot"

[project.scripts]
vpcopilot = "vpcopilot.cli:main"

[tool.hatch.build.targets.wheel]
packages = ["src/vpcopilot"]

[tool.hatch.build.targets.wheel.force-include]
"src/vpcopilot/console/static/index.html" = "vpcopilot/console/static/index.html"
# Ship the default per-agent model registry inside the package so a pip-installed user
# running outside the source tree still gets it (config.py falls back to this copy).
"config/agents.yaml" = "vpcopilot/config/agents.yaml"

[tool.hatch.build.targets.sdist]
# Whitelist what ships in the sdist so the pip-fallback build can't carry demo/internal
# scaffolding (vuln lab, benchmarks, Terraform estate, roadmap/backlog) to users.
include = [
  "/src",
  "/config",
  "/docs",
  "/README.md",
  "/CHANGELOG.md",
  "/LICENSE",
  "/NOTICE",
  "/pyproject.toml",
]
exclude = [
  "/bench",
  "/benchmarks",
  "/demo",
  "/infra",
  "/labs",
  "/out*",
  "/ROADMAP.md",
  "/BACKLOG.md",
]

[tool.pytest.ini_options]
# "." so `tests.live` (the live-suite harness) imports the same way however pytest is invoked.
# `python -m pytest` puts the CWD on sys.path and bare `pytest` does not, so without this the
# suite passed locally and failed in CI with `ModuleNotFoundError: No module named 'tests'` —
# `tests` was resolving as an implicit namespace package off the CWD. pytest applies `pythonpath`
# itself, so it holds for both invocations.
pythonpath = ["src", "."]
markers = [
  "live: hits a real XC tenant / model / network — excluded from CI (run manually / nightly)",
  "bench: runs the discovery benchmark — excluded from the fast CI job (has its own gate)",
]

[tool.ruff]
line-length = 120
src = ["src", "tests"]

[tool.ruff.lint]
# Pragmatic set for a demo codebase: pyflakes + a subset of pycodestyle + bugbear.
select = ["F", "E4", "E7", "E9", "B"]
# B008: typer uses `= typer.Option(...)` defaults on purpose.
# B904: many deterministic-spine raises intentionally wrap an error without chaining the traceback.
# E731: a few small inline lambdas (log sinks, HTML helpers) are deliberate.
# E701/E702: compact multi-statement lines are a deliberate style in the CLI/lab glue.
ignore = ["B008", "B904", "E731", "E701", "E702"]

[tool.ruff.lint.per-file-ignores]
"tests/*" = ["B011"]