pyproject.toml

[build-system]
requires = ["setuptools>=68.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "codeframe-ai"
version = "0.9.1"
description = "A project delivery system that orchestrates frontier coding agents: Think, Build, Prove, Ship."
readme = "README.md"
requires-python = ">=3.11"
license = {text = "AGPL-3.0-or-later"}
authors = [
    {name = "Frank Bria", email = "hello@codeframe.sh"}
]
keywords = ["ai", "agents", "autonomous", "coding", "development"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
]

dependencies = [
    "anthropic>=0.18.0",
    # Runtime, not dev (#910): `cf review`'s security leg shells out to bandit,
    # and when it was missing the scan silently produced no findings — so every
    # clean `pip install` scored 100 and reported "approved" without ever
    # running a security check.
    "bandit>=1.8.6",
    "tenacity>=8.2.0",
    "openai>=1.12.0",
    "fastapi>=0.109.0",
    "uvicorn[standard]>=0.27.0",
    "websockets>=12.0",
    "pydantic>=2.6.0",
    "pydantic-settings>=2.1.0",
    "python-dotenv>=1.2.2",
    "sqlalchemy>=2.0.0",
    "aiosqlite>=0.19.0",
    "aiohttp>=3.14.0",
    "httpx>=0.27.0",
    "typer>=0.9.0",
    "rich>=13.7.0",
    "textual>=0.86.0",
    "requests>=2.33.0",
    "gitpython>=3.1.50",
    "pyyaml>=6.0.0",
    "tree-sitter>=0.20.4",
    "tree-sitter-python>=0.20.4",
    "tree-sitter-javascript>=0.20.3",
    "tree-sitter-typescript>=0.20.3",
    "tiktoken>=0.12.0",
    "radon>=6.0.1",
    "pytest>=8.4.2",
    "ruff>=0.14.0",
    "pytest-asyncio>=1.2.0",
    "pytest-json-report>=1.5.0",
    "hypothesis>=6.148.0",
    "fastapi-users[sqlalchemy]>=15.0.2",
    "filelock>=3.0",
    "python-jose[cryptography]>=3.4.0",
    "passlib[argon2]>=1.7.4",
    "keyring>=24.0.0",
    "jinja2>=3.1.6",
    "slowapi>=0.1.9",
    "rapidfuzz>=3.0.0",
    # Security floors — pin transitive deps to patched versions for Dependabot CVE alerts (#659).
    # These are pulled by fastapi / fastapi-users / mcp / python-jose / keyring; floored here so
    # `uv lock` resolves to non-vulnerable versions regardless of the parents' lower bounds.
    "starlette>=1.0.1",       # Range-header FileResponse O(n^2) DoS (forces a compatible fastapi)
    "python-multipart>=0.0.27",  # arbitrary file write + DoS in multipart parsing
    "pyjwt>=2.12.0",          # accepts unknown `crit` header extensions
    "cryptography>=46.0.7",   # subgroup attack on SECT curves
    "urllib3>=2.7.0",         # header leak across redirects, decompression bombs
    "pyasn1>=0.6.3",          # decoder DoS / unbounded recursion
    "mcp>=1.23.0",            # DNS-rebinding protection off by default
    "idna>=3.15",             # DoS in IDNA processing
]

[project.optional-dependencies]
cloud = [
    "e2b>=2.0.0",
]
dev = [
    "pytest>=8.0.0",
    "pytest-asyncio>=0.23.0",
    "pytest-cov>=4.1.0",
    "pytest-json-report>=1.5.0",
    "pytest-timeout>=2.3.0",
    "black>=26.3.1",
    "ruff>=0.2.0",
    "mypy>=1.8.0",
    "pre-commit>=3.5.0",
    "hypothesis>=6.0.0",
    "e2b>=2.0.0",
    "jsonschema>=4.0.0",  # codex app-server protocol contract test (#914)
]

[project.scripts]
codeframe = "codeframe.cli.app:main"
cf = "codeframe.cli.app:main"  # Short alias for convenience

[project.urls]
Homepage = "https://github.com/frankbria/codeframe"
Repository = "https://github.com/frankbria/codeframe"
Issues = "https://github.com/frankbria/codeframe/issues"

[tool.setuptools]
include-package-data = true

[tool.setuptools.packages.find]
include = ["codeframe*"]
exclude = ["codeframe.tests*", "tests*", "web-ui*", "legacy*"]

[tool.setuptools.package-data]
codeframe = ["templates/*", "templates/**/*"]

[tool.black]
line-length = 100
target-version = ['py311']

[tool.ruff]
line-length = 100
target-version = "py311"
exclude = [
    ".venv/",
    "build/",
    "dist/",
]

[tool.ruff.lint.per-file-ignores]
"tests/**" = ["F841"]  # Allow unused variables in tests

[tool.mypy]
python_version = "3.11"
warn_return_any = false
warn_unused_configs = true
disallow_untyped_defs = false
check_untyped_defs = false

# Only check critical modules for type safety (Sprint 10 core code)
# Exclude all other modules to unblock CI
[[tool.mypy.overrides]]
module = [
    "codeframe.*",
]
ignore_errors = true

# Enable strict checking only for Sprint 10 core modules
[[tool.mypy.overrides]]
module = [
    "codeframe.core.models",
    "codeframe.lib.quality_gates",
    "codeframe.lib.checkpoint_manager",
    "codeframe.lib.metrics_tracker",
]
ignore_errors = false
disallow_untyped_defs = true

[tool.coverage.run]
branch = true
source = ["codeframe"]

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    "def __repr__",
    "raise AssertionError",
    "raise NotImplementedError",
    "if __name__ == \"__main__\":",
]

[dependency-groups]
dev = [
    "pytest-cov>=7.0.0",
]