pyproject.toml

[build-system]
requires = ["hatchling>=1.18"]
build-backend = "hatchling.build"

[project]
name = "patchdiff-ai"
version = "2.0.16"
description = "Turn a CVE ID into a binary-diff root-cause-analysis report — MSRC patches, IDA Pro + BinDiff, LLM-driven RE."
readme = "readme.md"
requires-python = ">=3.11"
keywords = [
    "security",
    "vulnerability-research",
    "reverse-engineering",
    "patch-diff",
    "binary-diff",
    "ida-pro",
    "bindiff",
    "msrc",
    "cve",
    "rca",
    "langgraph",
]
classifiers = [
    "Development Status :: 4 - Beta",
    "Environment :: Console",
    "Intended Audience :: Information Technology",
    "Intended Audience :: System Administrators",
    "Operating System :: Microsoft :: Windows :: Windows 10",
    "Operating System :: Microsoft :: Windows :: Windows 11",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3 :: Only",
    "Topic :: Security",
    "Topic :: Software Development :: Disassemblers",
    "Topic :: Software Development :: Libraries :: Python Modules",
]
dependencies = [
    # Versions are frozen to the working set; bump deliberately, not casually.
    # langchain 1.x is the floor (`langchain.agents.create_agent` replaced
    # the deprecated `langgraph.prebuilt.create_react_agent`).
    "azure-core==1.39.0",
    "azure-identity==1.25.3",
    "chromadb==1.5.8",
    "click>=8.1",
    "langchain==1.2.15",
    "langchain-anthropic==1.4.1",
    "langchain-chroma==1.1.0",
    "langchain-community==0.4.1",
    "langchain-core==1.3.2",
    "langchain-google-genai==3.2.0",
    "langchain-openai==1.2.1",
    "langgraph==1.1.10",
    "langgraph-checkpoint==4.0.3",
    # IDA Pro MCP — drives idalib in a headless subprocess; pulled from GitHub
    # because there's no PyPI package. Pinned to a specific commit so reinstalls
    # are deterministic; bump the SHA deliberately when upgrading.
    # `mcp` (the SDK + streamable-http transport) comes transitively through
    # this dependency — no need to pin separately.
    "ida-pro-mcp @ git+https://github.com/mrexodia/ida-pro-mcp.git@40e94f36f94043fd1824661e32ad72a903ec9e2f",
    "lxml_html_clean==0.4.4",
    "pefile==2024.8.26",
    "polars==1.40.1",
    "pydantic==2.13.3",
    "pydantic-settings==2.14.0",
    "python-bindiff==0.3.4",
    "python-binexport==0.4.2",
    "python-dateutil==2.9.0.post0",
    "python-dotenv==1.2.2",
    "requests==2.33.1",
    "requests-html==0.10.0",
    "rich==15.0.0",
    "structlog==25.5.0",
    "tenacity==9.1.4",
]

[project.scripts]
patchdiff-ai = "patchdiff_ai.cli.app:main"

[tool.hatch.metadata]
# `ida-pro-mcp` is sourced from GitHub (no PyPI release). Direct refs are
# rejected by default; enable explicitly so editable installs work.
allow-direct-references = true

[tool.hatch.build.targets.wheel]
packages = ["src/patchdiff_ai"]

# Project the bundled BinDiff/BinExport DLLs (~9.5 MB, IDA 9.3) and
# `UpdateCompression.dll` into the wheel under
# `patchdiff_ai/_resources/`. Outside the package in the source tree so
# the dev layout (`resources/...`) stays intact; `runtime/paths.py`
# checks both locations at runtime so editable installs hit the
# source-tree copy. The 3 GB `windows_sxs/` tree is intentionally NOT
# bundled — users build it locally via `patchdiff-ai windows index ...` into
# `<data_root>/windows_sxs/`.
[tool.hatch.build.targets.wheel.force-include]
"resources/bindiff_ida_9.3" = "patchdiff_ai/_resources/bindiff_ida_9.3"
"resources/UpdateCompression.dll" = "patchdiff_ai/_resources/UpdateCompression.dll"

[tool.hatch.build.targets.sdist]
include = [
    "src/patchdiff_ai",
    "resources/bindiff_ida_9.3",
    "resources/UpdateCompression.dll",
    "readme.md",
]