pyproject.toml

[project]
name = "decepticon"
# Sentinel — replaced with the git tag at Docker build time via ARG VERSION
# in containers/langgraph.Dockerfile. Source-tree value is intentionally
# stable (not bumped per release) so contributors never need a manual
# version commit before tagging.
version = "0.0.0"
description = "AI-powered autonomous red team testing framework"
readme = "README.md"
license = { text = "Apache-2.0" }
license-files = ["LICENSE"]
requires-python = ">=3.13"

authors = [
    { name = "Decepticon Team" }
]

keywords = [
    "ai", "security", "red-team", "penetration-testing",
    "llm", "langchain", "langgraph", "autonomous-agents"
]

classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "License :: OSI Approved :: Apache Software License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
]

dependencies = [
    # Core
    "pydantic>=2.0.0",
    "pydantic-settings>=2.0.0",
    "pyyaml>=6.0.0",
    "python-dotenv>=1.0.0",
    # LLM
    "langchain-core>=0.3.0",
    "langchain-openai>=0.3.0",
    "langchain-anthropic>=0.3.0",
    "langgraph>=1.0.0",
    "langgraph-cli[inmem]>=0.2.0",
    "langgraph-sdk>=0.1.0",
    # HTTP
    "httpx>=0.27.0",
    "deepagents>=0.4.4",
    # CLI
    "typer[all]>=0.9.0",
    "xxhash>=3.0.0",
    # Security
    "defusedxml>=0.7.0",
    # Graph memory (Neo4j attack-chain graph)
    "neo4j>=5.0",
]

[dependency-groups]
dev = [
    "pytest>=8.0.0",
    "pytest-asyncio>=0.23.0",
    "pytest-cov>=4.0.0",
    "pytest-xdist>=3.6.0",
    "ruff>=0.4.0",
    "basedpyright>=1.37.0",
]

[project.scripts]
decepticon-kg-health = "decepticon.tools.research.health:main"

[project.urls]
Homepage = "https://github.com/PurpleAILAB/Decepticon"
Repository = "https://github.com/PurpleAILAB/Decepticon"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["decepticon"]

[tool.ruff]
line-length = 100
target-version = "py313"
extend-exclude = [
    "benchmark/xbow-validation-benchmarks",
    "benchmark/results",
]

[tool.ruff.lint]
select = ["E", "F", "I", "W"]
ignore = ["E501"]

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
markers = [
    "asyncio: mark test as async (pytest-asyncio)",
    "slow: integration-style tests that hit wall-clock timeouts or otherwise take seconds; deselected from the PR fast lane",
]
addopts = [
    "--strict-markers",
    "--strict-config",
    "-ra",
]

[tool.coverage.run]
source = ["decepticon"]
branch = true
omit = [
    "decepticon/__main__.py",
    "decepticon/auth/providers/*",
]

[tool.coverage.html]
directory = "htmlcov"

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    "raise NotImplementedError",
    "if TYPE_CHECKING:",
    "if __name__ == .__main__.:",
    "\\.\\.\\.",
]
show_missing = true
skip_covered = false

[tool.basedpyright]
pythonVersion = "3.13"
include = ["decepticon", "tests", "benchmark"]
exclude = [
    "**/__pycache__",
    "**/node_modules",
    "reference",
    "decepticon/auth/providers",
    "benchmark/xbow-validation-benchmarks",
    "benchmark/results",
]
# Use pyright "standard" semantics rather than the basedpyright "all" default —
# the existing codebase predates basedpyright's stricter rules. As code is
# annotated over time, individual reports can be ratcheted back to "error".
typeCheckingMode = "standard"
reportMissingImports = "warning"
reportMissingTypeStubs = "none"
# Unknown types — common with langchain/langgraph dynamic interfaces
reportUnknownMemberType = "none"
reportUnknownArgumentType = "none"
reportUnknownVariableType = "none"
reportUnknownParameterType = "none"
reportUnknownLambdaType = "none"
reportMissingTypeArgument = "none"
# basedpyright extras that fire on idiomatic Python
reportAny = "none"
reportExplicitAny = "none"
reportImplicitOverride = "none"
reportUnusedCallResult = "none"
reportUnannotatedClassAttribute = "none"
reportUninitializedInstanceVariable = "none"
reportImplicitStringConcatenation = "none"
reportPrivateUsage = "none"
reportImportCycles = "none"
reportPropertyTypeMismatch = "none"
reportIgnoreCommentWithoutRule = "none"
# Demote pre-existing issues to warnings (still surfaced, but non-blocking).
# Real attribute-access bugs in newly-written code should still be caught:
# add a # pyright: ignore[reportAttributeAccessIssue] comment at the call site
# instead of escalating this back to "error" wholesale.
reportAttributeAccessIssue = "warning"
reportOperatorIssue = "warning"
reportArgumentType = "warning"
reportCallIssue = "warning"
reportAssignmentType = "warning"
reportReturnType = "warning"
reportGeneralTypeIssues = "warning"