switch-trust-cli/pyproject.toml at main · sandbox-quantum/switch-trust-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
[project]
name = "switch-trust-cli"
version = "1.7.2"
description = "Command-line tool for evaluating agents, offering two features to assess agents via code scanning (`switch-trust scan`, whitebox testing) and runtime evaluation (`switch-trust eval`, blackbox testing)"
readme = "README.md"
license = { file = "LICENSE" }
requires-python = ">=3.11"
authors = [
  { name = "SandboxAQ", email = "info@switchagents.ai" },
]
dependencies = [
  "aiohttp>=3.14.3",
  "anthropic==0.87.0",
  # Direct floor pin for transitive dependency of google-adk->google-auth
  # required for `pip-compile` to resolve the dependency tree.
  "pyOpenSSL>=26.4.0",
  # Direct floor pin for a transitive dependency to pull in the security fix
  # for PYSEC-2026-3552 (PKCS#7 Bleichenbacher oracle).
  "cryptography>=50.0.0",
  "bandit==1.9.4",
  "cvss>=2.6",
  "datafog>=4.4.0",
  "dataclasses-json==0.6.7",
  "detect-secrets==1.5.0",
  "google-adk==2.2.0",
  "litellm>=1.83.7",
  "openai==2.29.0",
  # Cap opentelemetry at 1.41.1 to match google-adk's hard ceiling
  # (opentelemetry-api/sdk >=1.36,<=1.41.1). Without the cap, pip-compile
  # grabs the newest otel (1.42+) then backtracks the whole otel stack down
  # in lockstep, which is slow and can spuriously hit ResolutionImpossible.
  "opentelemetry-api>=1.38.0,<=1.41.1",
  "opentelemetry-exporter-otlp-proto-http>=1.38.0,<=1.41.1",
  "opentelemetry-sdk>=1.38.0,<=1.41.1",
  "pip-audit==2.10.1",
  # google-adk chains the whole otel stack to <=1.42.1, whose
  # opentelemetry-proto still requires protobuf<7.0, while google-api-core /
  # googleapis-common-protos / grpcio-status require protobuf>=6.33.5. That
  # leaves 6.33.x as the only viable window; pin it so the resolver lands
  # there directly instead of backtracking down from protobuf 7.x.
  "protobuf>=6.33.5,<7",
  "pydantic==2.12.5",
  "python-dotenv==1.2.2",
  "requests>=2.33.0",
  "rich>=13.0",
  "msgpack>=1.2.1",
  "pydantic-settings>=2.14.2",
]

[project.optional-dependencies]
# Heavy ML backends kept out of the core install. ``garak`` powers garak probes
# and detectors; ``transformers[torch]`` powers toxicity detection and the
# local evaluation of models retrieved from HuggingFace (torch alone is ~2 GB
# and also pulls in Cuda on Linux). Install with
# ``pip install switch-trust-cli[full]``.
full = [
  "garak==0.14.0",
  "transformers[torch]==5.10.1",
]

[dependency-groups]
dev = [
  "pip-licenses>=5.0",
  "cyclonedx-bom>=6.0",
  "pip-audit>=2.7",
  "pip-tools>=7.4",
  "pytest>=9.1.1",
]

[build-system]
requires = ["setuptools>=61.0"]
build-backend = "setuptools.build_meta"

[tool.setuptools.packages.find]
include = ["switch_trust*"]

[tool.setuptools.package-data]
switch_trust = [
    "**/*.json",
    "**/*.yaml",
    "**/*.yml",
    "**/*.txt",
    "**/*.csv",
]

[project.scripts]
switch-trust = "switch_trust.cli.main:main"

# TODO(rebrand): these point at the intended new repo, which doesn't exist yet.
# Update once sandbox-quantum/switch-trust is created.
[project.urls]
Homepage = "https://github.com/sandbox-quantum/switch-trust-cli"
Issues = "https://github.com/sandbox-quantum/switch-trust-cli/issues"