pyproject.toml

[project]
name = "trading"
version = "1.0.0"
description = "SPY options trading system with broker sync, safety gates, and local RAG tooling"
readme = "README.md"
requires-python = ">=3.11,<3.12"                                                                 # CI uses Python 3.11
license = { text = "MIT" }
authors = [{ name = "Igor Ganapolsky" }]
keywords = ["trading", "alpaca", "ai", "automation", "stocks", "options"]

dependencies = [
  # Trading APIs
  "alpaca-py>=0.43.4",
  "openai>=1.109.1",
  # "openai-agents>=0.6.2",  # REMOVED: Never imported (Jan 2026)

  # Data Processing
  "pandas>=2.3.3",
  "numpy>=2.4.6,<3.0.0",      # <2.0 for langchain compatibility
  "yfinance>=0.2.58,<0.2.66", # Stable version without websocket conflicts
  "alpha-vantage>=2.3.1",

  # Scheduling
  # "schedule>=1.2.0",  # REMOVED: Never imported (Jan 2026)

  # Web Scraping & APIs
  "requests>=2.34.2",
  "beautifulsoup4>=4.14.3",
  "lxml>=6.1.1",
  "praw>=7.8.2",
  # "feedparser>=6.0.10",  # REMOVED: Never imported (Jan 2026)
  # "PyPDF2>=3.0.0",  # REMOVED: Never imported (Jan 2026)

  # YouTube Monitoring
  "youtube-transcript-api>=1.2.3",

  # Configuration
  "python-dotenv>=1.2.2",
  "pydantic-settings>=2.14.2,<3.0.0",
  "PyYAML>=6.0.3,<8.0.0",

  # Utilities
  "python-dateutil>=2.9.0",
  # "pytz>=2023.3",  # REMOVED: Never imported (Jan 2026)
  "holidays>=0.97", # Market holiday detection (Critical for calendar awareness - LL-051)
  # "loguru>=0.7.2",  # REMOVED: Never imported (Jan 2026)
  "anthropic>=0.109.1,<1.0.0",
  "google-generativeai>=0.8.6,<1.0.0",

  # Deep Learning
  # "torch>=2.0.0,<3.0.0",  # REMOVED: Never imported (Jan 2026)
  "scikit-learn>=1.9.0,<2.0.0", # Used in src/agents/rl_weight_updater.py

  # DeepAgents Integration (updated for deepagents 0.3.x compatibility)
  "langchain>=1.3.9",
  "langchain-core>=1.4.7",      # CVE: f-string validation in prompt templates
  "langchain-anthropic>=1.4.6",
  "langchain-community>=0.4.2",
  # "langgraph>=0.2.0",  # REMOVED: Never imported (Jan 2026)
  "langsmith>=0.8.18",

  # Dashboard
  # "streamlit>=1.40.0",  # REMOVED: Never imported (Jan 2026)
  # "matplotlib>=3.7.0",  # REMOVED: Never imported (Jan 2026)
]

[project.optional-dependencies]
dev = [
  "pytest>=9.0.3",          # CVE: tmpdir handling vulnerability in <9.0.3
  "pytest-asyncio>=0.21.1",
  "pytest-cov>=4.1.0",
  "pytest-timeout>=2.2.0",
  "ruff>=0.15.17",
  "mypy>=1.20.2",
  "pre-commit>=3.8.0",
]

security = ["detect-secrets>=1.5.0", "bandit>=1.9.4"]

rag = [
  "sentence-transformers>=2.7.0",
  "lancedb>=0.30.2",
  "chromadb>=0.6.3,<1.0.0",
  "msgpack>=1.2.1",
  "torch>=2.12.1,<3.0.0",
]

# deepagents = [  # REMOVED: Never imported (Jan 2026)
#     "deepagents>=0.2.5",
# ]

xai = [
  # X.ai SDK - optional due to packaging conflicts with streamlit
  "xai-sdk>=1.17.0",
]

[project.urls]
Homepage = "https://github.com/IgorGanapolsky/trading"
Repository = "https://github.com/IgorGanapolsky/trading"
Issues = "https://github.com/IgorGanapolsky/trading/issues"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src"]

# Ruff - Fast Python linter and formatter (replaces black, flake8, isort)
[tool.ruff]
line-length = 100
target-version = "py310"
src = ["src", "tests"]
exclude = [
  ".git",
  ".venv",
  "venv",
  "__pycache__",
  "*.pyc",
  "*.txt",                    # Exclude requirements files
  "*.in",                     # Exclude pip-compile input files
  "data",
  "reports",
  "research",                 # Experimental code, not production
  ".claude/scripts/feedback", # Internal RLHF tools, not production code
]

[tool.ruff.lint]
select = [
  "E",   # pycodestyle errors
  "W",   # pycodestyle warnings
  "F",   # Pyflakes
  "I",   # isort
  "UP",  # pyupgrade
  "B",   # flake8-bugbear
  "SIM", # flake8-simplify
  "S",   # flake8-bandit (security)
]
ignore = [
  "E501",   # line too long (handled by formatter)
  "E402",   # module level import not at top (intentional for sys.path setup)
  "E722",   # bare except (used for broad error handling in trading)
  "S101",   # assert usage (needed for tests)
  "S105",   # hardcoded password (false positives)
  "S106",   # hardcoded password (false positives)
  "S110",   # try-except-pass (legitimate error suppression in trading)
  "S112",   # try-except-continue (legitimate in data processing)
  "S311",   # pseudo-random not cryptographic (trading doesn't need secure random)
  "S113",   # requests timeout (handled at application level)
  "S310",   # URL scheme audit (internal URLs only)
  "S324",   # md5 usage (used for checksums, not security)
  "S602",   # shell=True subprocess (controlled internal scripts)
  "S603",   # subprocess check (scripts are controlled)
  "S607",   # partial path (intentional for flexibility)
  "S314",   # xml parsing (internal XML only)
  "B007",   # unused loop variable (often intentional for unpacking)
  "B027",   # empty abstract method (stubs for optional methods)
  "B904",   # exception chaining (not critical for trading)
  "SIM102", # nested if statements (readability preference)
  "SIM105", # contextlib.suppress (readability preference)
  "SIM108", # ternary operator (readability preference)
  "SIM117", # nested with statements (readability preference)
  "UP035",  # prefer collections.abc imports (not yet migrated)
  "UP045",  # use X | None (keep Optional for py39 compatibility)
  "UP007",  # pipe unions (not yet migrated)
  "B905",   # zip strict parameter (backlog)
]

[tool.ruff.lint.per-file-ignores]
# Tests use sys.path manipulation which breaks isort (I001)
"tests/*" = ["S101", "S105", "S106", "I001"]
"tests/unit/*" = ["S101", "S105", "S106", "I001"]
# Files that check library availability via import
"scripts/check_alpaca_minimum_orders.py" = ["F401"]
"scripts/test_langsmith.py" = ["F401"]
".claude/skills/*/scripts/*.py" = ["F401"]
# Init files that re-export
"src/risk/__init__.py" = ["F401"]
"src/rag/__init__.py" = ["F401"]

[tool.ruff.format]
quote-style = "double"
indent-style = "space"

# Mypy - Static type checker
[tool.mypy]
python_version = "3.9"
mypy_path = "."
namespace_packages = true
explicit_package_bases = true
warn_return_any = true
warn_unused_configs = true
ignore_missing_imports = true
exclude = ["venv", ".venv", "data", "reports"]

# Pytest configuration
[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = ["test_*.py"]
python_functions = ["test_*"]
asyncio_mode = "auto"
timeout = 120
addopts = "-v --tb=short"
filterwarnings = [
  "ignore::DeprecationWarning",
  "ignore::PendingDeprecationWarning",
]

# Coverage configuration
[tool.coverage.run]
source = ["src"]
omit = ["tests/*", "venv/*", ".venv/*"]

[tool.coverage.report]
exclude_lines = [
  "pragma: no cover",
  "def __repr__",
  "raise NotImplementedError",
  "if __name__ == .__main__.:",
]

# Poetry compatibility for workflows that still read tool.poetry
[tool.poetry.dependencies]
python = ">=3.11,<3.12"