pyproject.toml

[project]
name = "f0_sectools"
version = "0.2.1"
description = "Security-operations tools, skills, and MCP servers for local AI agents — privacy-first, small-model-driven."
readme = "README.md"
requires-python = ">=3.11"
license = { text = "Apache-2.0" }
authors = [{ name = "F0RT1KA Contributors" }]
keywords = ["security", "mcp", "soc", "siem", "edr", "llm", "local-llm", "agents"]

# The root is a virtual workspace coordinator; runtime code lives in the member
# packages under core/ and servers/. Sync the whole workspace with
# `uv sync --all-packages` to install every member (editable) and its deps.
dependencies = []

# Dev tooling lives in a dependency group (installed by default by `uv sync`).
[dependency-groups]
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "respx>=0.21",
    "pyyaml>=6.0",
    "ruff>=0.6",
    "mypy>=1.10",
]

[tool.uv]
# The root itself is not a distributable package — it only coordinates members.
package = false

[tool.uv.workspace]
# Each platform server and the shared core are workspace members.
members = ["core", "servers/*"]

[tool.ruff]
target-version = "py311"
line-length = 100

[tool.ruff.lint]
select = ["E", "F", "I", "B", "UP", "S"]  # incl. flake8-bandit (S) for a security repo
ignore = []

[tool.ruff.lint.per-file-ignores]
# Tests legitimately use `assert` (S101) and dummy/hardcoded credential fixtures
# (S105/S106). These bandit checks are noise in test code, not production code.
# Match both tests/ packages and standalone test_*.py files (e.g. under evals/).
"**/tests/**" = ["S101", "S105", "S106"]
"**/test_*.py" = ["S101", "S105", "S106"]

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["core", "servers", "evals", "skills", "scripts", "integrations"]
# importlib mode lets same-basename test files (e.g. each server's
# tests/test_tools.py) coexist without module-name collisions.
addopts = "--import-mode=importlib"
# Make the repo root importable so `evals` (the eval harness) resolves in tests.
pythonpath = ["."]

[tool.mypy]
python_version = "3.11"
strict = true
# The hard gate covers shipped source only (core + each server's package).
# Tests (mocks/fixtures/respx), the eval harness, and smoke scripts are excluded:
# strict-typing them is high-noise, low-value, and the duplicate `test_tools.py`
# filenames across servers otherwise jam module resolution before any check runs.
exclude = [
    '(^|/)tests/',
    '(^|/)test_[^/]*\.py$',
    '^evals/',
    '^scripts/',
    '^skills/',
]

# WeasyPrint is an optional extra ([reports]); it has no type stubs and is not
# installed in CI. Ignore it uniformly so the typecheck passes whether or not the
# extra is present (absent -> import-not-found; present -> import-untyped).
[[tool.mypy.overrides]]
module = ["weasyprint"]
ignore_missing_imports = true