[build-system]
requires = ["uv_build>=0.8.13,<0.9.0"]
build-backend = "uv_build"

[project]
name = "openultrasast"
version = "1.2.0a1"
description = "OpenCode-oriented SAST harness for evidence-gated security analysis"
readme = "README.md"
requires-python = ">=3.11"
dependencies = []

[project.optional-dependencies]
# HarnessX is the optional agentic plane (LLM hunter/verifier + self-improvement).
# SHA-pinned for reproducibility; the heavy transitive footprint (see
# .kiro/specs/harnessx-self-improving-rulesets/dependency-audit.md) lands ONLY when
# this extra is installed. The core install stays zero-dependency and every HarnessX
# import is guarded by openultrasast.harness_ext (lazy). pip does not pull the
# recipe/verl_harnessX submodule (it is outside the packaged harnessx* modules).
harnessx = [
    "harnessx @ git+https://github.com/Darwin-Agent/HarnessX.git@274c512eea67c64701f992d3b6fe06f0fd590ef0",
]
# Structured parse for overlay (JS/C/C++/Java/Python). Core install stays empty.
# Wheels are MIT; import is lazy via openultrasast.semantic.extra.
semantic = [
    "tree-sitter>=0.23,<0.27",
    "tree-sitter-python>=0.23",
    "tree-sitter-javascript>=0.23",
    "tree-sitter-typescript>=0.23",
    "tree-sitter-c>=0.23",
    "tree-sitter-cpp>=0.23",
    "tree-sitter-java>=0.23",
]

[project.scripts]
ousast = "openultrasast.cli:main"

[tool.pytest.ini_options]
testpaths = ["tests"]
pythonpath = ["src"]
markers = [
    "docker: requires a docker daemon",
    "semantic: requires openultrasast[semantic] tree-sitter extra",
]

[tool.ruff]
line-length = 140
target-version = "py311"
# Benchmark fixtures are intentionally vulnerable, unformatted sample corpora;
# linting/formatting them would flag the planted bugs and shift ground-truth lines.
extend-exclude = ["benchmarks/fixtures", "benchmarks/pairs"]

[tool.ruff.lint]
select = ["B", "E", "F", "I", "SIM", "UP"]

[tool.mypy]
python_version = "3.11"
files = ["src/openultrasast"]
check_untyped_defs = true
disallow_untyped_defs = true
no_implicit_optional = true
warn_redundant_casts = true
warn_return_any = true
warn_unused_configs = true

# HarnessX is an optional extra, absent in the type-check environment; its lazy
# imports inside guarded functions must not fail mypy.
[[tool.mypy.overrides]]
module = "harnessx.*"
ignore_missing_imports = true

[[tool.mypy.overrides]]
module = "tree_sitter"
ignore_missing_imports = true

[dependency-groups]
dev = [
    "dagger-io>=0.21.7",
    "mypy>=2.1.0",
    "pre-commit>=4.6.0",
    "pytest>=8",
    "ruff>=0.15.17",
]