pyproject.toml

[project]
name = "cve-reverser"
version = "0.2.0"
description = "Reverse WordPress plugin CVEs from their patches into local-lab PoCs + Nuclei detection templates — a traced RLM framework on rlm-kit (a downstream consumer)."
readme = "README.md"
requires-python = ">=3.11"
license = "MIT"
authors = [{ name = "Boik Su" }]
keywords = ["rlm", "dspy", "cve", "wordpress", "security-research", "bug-bounty", "nuclei"]
dependencies = [
    # rlm-kit is consumed via a git source until it ships on PyPI (see [tool.uv.sources]).
    "rlm-kit",
    "pydantic>=2.9",
    "pyyaml>=6.0",
    "httpx>=0.27",   # the direct fetch provider + the feed transport + host-side GitHub publish
    "openai>=1.0",   # the self-authoring template generator (template_backend="self")
    "jsonschema>=4.0",  # authoritative postprocess validation against the vendored Nuclei JSON schema
]

[project.scripts]
cve-reverser = "cve_reverser.cli:main"

[dependency-groups]
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.24",
]

# rlm-kit is public but not yet on PyPI, so it comes in via git (uv.lock pins the exact commit); swap to
# a version spec once it ships on PyPI. The dogfooding loop rlm-kit is designed around still holds: when
# co-developing rlm-kit locally, overlay an editable install (`uv pip install -e ../rlm-kit`) or bump
# this ref after pushing, so a fix that surfaces here can be promoted into the kit.
[tool.uv.sources]
rlm-kit = { git = "https://github.com/qazbnm456/rlm-kit.git", branch = "main" }

# The visualization console ships IN-REPO as its own package (studio/) — a uv workspace member, NOT part
# of the `cve_reverser` wheel. It reads this package's trace/ReversalResponse contract, so co-locating
# keeps them in sync; its web stack (fastapi/uvicorn/frontend) stays behind the package boundary + the
# `live` optional extra, so a harness-only install never pulls it. External path sources (rlm-kit) live
# here at the workspace root and apply to every member.
[tool.uv.workspace]
members = ["studio"]

[tool.pytest.ini_options]
pythonpath = ["."]
asyncio_mode = "auto"
testpaths = ["tests"]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
# `packages` already includes every file under the package dir — the skills/*.md, the vendored
# nuclei_jsonschema.json, and VENDOR.md all ship automatically. (A redundant force-include of
# `cve_reverser/skills` used to duplicate those paths and broke the wheel build.)
packages = ["cve_reverser"]