agentevals-cli 0.9.7__tar.gz → 0.9.9__tar.gz

agentevals_cli-0.9.9/.github/dependabot.yml

@@ -0,0 +1,101 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 2
+    labels: ["dependencies", "CI"]
+    commit-message:
+      prefix: "chore(deps):"
+    cooldown:
+      default-days: 5
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns: ["*"]
+      github-actions-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "CLI"]
+    commit-message:
+      prefix: "chore(deps):"
+      prefix-development: "chore(deps-dev):"
+    cooldown:
+      default-days: 5
+      semver-major-days: 14
+    groups:
+      python-google-ai:
+        applies-to: version-updates
+        patterns:
+          - "google-adk"
+          - "google-genai"
+          - "google-auth*"
+      python:
+        applies-to: version-updates
+        patterns: ["*"]
+      python-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  - package-ecosystem: "npm"
+    directory: "/ui"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 2
+    labels: ["dependencies", "UI"]
+    commit-message:
+      prefix: "chore(deps):"
+      prefix-development: "chore(deps-dev):"
+    cooldown:
+      default-days: 5
+      semver-major-days: 14
+    ignore:
+      # Majors need a migration pass; bump these by hand.
+      - dependency-name: "react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "antd"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "vite"
+        update-types: ["version-update:semver-major"]
+      # Plugin majors track vite majors: @vitejs/plugin-react 6 peers on vite 8.
+      - dependency-name: "@vitejs/*"
+        update-types: ["version-update:semver-major"]
+      # typescript-eslint declares a typescript upper bound, so TS majors move with it.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
+    groups:
+      npm:
+        applies-to: version-updates
+        patterns: ["*"]
+      npm-security:
+        applies-to: security-updates
+        patterns: ["*"]
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 1
+    labels: ["dependencies"]
+    commit-message:
+      prefix: "chore(deps):"
+    cooldown:
+      default-days: 5
+    groups:
+      docker-base-images:
+        applies-to: version-updates
+        patterns: ["*"]

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
   helm-chart:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Lint + template
         run: make helm-test
@@ -21,14 +21,17 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
+      - name: Verify uv.lock matches pyproject.toml
+        run: uv lock --check
+
       - name: Install dependencies
         run: |
           uv venv
@@ -41,17 +44,32 @@ jobs:
       - name: Ruff format check
         run: uv run ruff format --check .
 
+  ui:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: ui/package-lock.json
+
+      # tsc -b && vite build, same as the release workflow bundles.
+      - name: Build UI
+        run: make build-ui
+
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
@@ -62,7 +80,7 @@ jobs:
         run: |
           uv venv --python ${{ matrix.python-version }}
           uv pip install setuptools
-          uv sync --dev --python ${{ matrix.python-version }}
+          uv sync --dev --all-extras --frozen --python ${{ matrix.python-version }}
 
       - name: Run tests
         run: uv run pytest -m "not integration and not e2e" --tb=short -q

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/.github/workflows/publish-evaluator-sdk.yml

@@ -18,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout GitHub Action'
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       # Repo root cwd: uv build puts artifacts in ./dist; uv publish looks for dist/* relative to cwd.
       - name: 'Release Python Packages'

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/.github/workflows/release.yml

@@ -17,16 +17,16 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -35,7 +35,7 @@ jobs:
       - name: Build core and bundled wheels
         run: make release
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels
           path: |
@@ -46,16 +46,16 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -82,12 +82,12 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: wheels
           path: dist/
 
-      - uses: softprops/action-gh-release@v2.5.0
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           files: dist/**/*.whl
@@ -100,22 +100,22 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         run: |
@@ -134,12 +134,12 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.inputs.tag || github.ref_name }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/Dockerfile

@@ -32,6 +32,12 @@ ARG VERSION
 ENV SETUPTOOLS_SCM_PRETEND_VERSION=${VERSION}
 
 RUN uv sync --frozen --no-dev --extra live --extra postgres --extra kubernetes \
+    # The runtime only uses the uv-managed venv; drop the base image's bundled
+    # pip so its vendored packages (msgpack, pkg_resources) don't ship unused.
+    && rm -rf /usr/local/lib/python*/site-packages/pip \
+              /usr/local/lib/python*/site-packages/pip-*.dist-info \
+              /usr/local/bin/pip* \
+    && ! /usr/local/bin/python -c "import pip" 2>/dev/null \
     && groupadd --gid 1000 app \
     && useradd --uid 1000 --gid app --home-dir /app --no-log-init app \
     && chown -R app:app /app

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/PKG-INFO

@@ -1,24 +1,35 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: agentevals-cli
-Version: 0.9.7
+Version: 0.9.9
 Summary: Standalone framework to evaluate agent correctness based on portable OpenTelemetry traces
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: click>=8.0
+Requires-Dist: aiohttp>=3.14.3
+Requires-Dist: authlib>=1.7.2
+Requires-Dist: click>=8.3.3
 Requires-Dist: fastapi>=0.115.0
-Requires-Dist: google-adk[eval]<2.2,>=2.1.0
+Requires-Dist: google-adk[eval]<3,>=2.5.0
 Requires-Dist: httpx>=0.27.0
+Requires-Dist: idna>=3.18
+Requires-Dist: litellm>=1.85.7
+Requires-Dist: nltk>=3.10.2
 Requires-Dist: opentelemetry-proto>=1.36.0
-Requires-Dist: python-dotenv>=1.0.0
-Requires-Dist: python-multipart>=0.0.12
+Requires-Dist: pyasn1>=0.6.4
+Requires-Dist: pygments>=2.20.0
+Requires-Dist: python-dotenv>=1.2.2
+Requires-Dist: python-multipart>=0.0.32
 Requires-Dist: pyyaml>=6.0
+Requires-Dist: requests>=2.34.2
 Requires-Dist: tabulate>=0.9.0
+Requires-Dist: urllib3>=2.7.0
 Requires-Dist: uvicorn[standard]>=0.32.0
 Provides-Extra: kubernetes
 Requires-Dist: kubernetes>=36.0.0; extra == 'kubernetes'
 Provides-Extra: live
 Requires-Dist: httpx>=0.27.0; extra == 'live'
-Requires-Dist: mcp>=1.26.0; extra == 'live'
+Requires-Dist: mcp<2,>=1.28.1; extra == 'live'
+Requires-Dist: pydantic-settings>=2.15.0; extra == 'live'
+Requires-Dist: pyjwt>=2.13.0; extra == 'live'
 Provides-Extra: openai
 Requires-Dist: openai>=2.0; extra == 'openai'
 Provides-Extra: postgres

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/docs/custom-evaluators.md

@@ -37,6 +37,7 @@ pip install agentevals-evaluator-sdk
 # evaluators/response_quality.py
 from agentevals_evaluator_sdk import evaluator, EvalInput, EvalResult
 
+
 @evaluator
 def response_quality(input: EvalInput) -> EvalResult:
     scores = []
@@ -53,6 +54,7 @@ def response_quality(input: EvalInput) -> EvalResult:
         per_invocation_scores=scores,
     )
 
+
 if __name__ == "__main__":
     response_quality.run()
 ```
@@ -436,7 +438,7 @@ Then register it:
 _RUNTIMES: list[Runtime] = [
     PythonRuntime(),
     NodeRuntime(),
-    GoRuntime(),       # new
+    GoRuntime(),  # new
 ]
 ```
 
@@ -484,6 +486,7 @@ To support a different evaluator registry (e.g., a custom API), implement `Evalu
 ```python
 from agentevals.evaluator.sources import EvaluatorSource, EvaluatorInfo, register_source
 
+
 class MyRegistrySource(EvaluatorSource):
     @property
     def source_name(self) -> str:
@@ -492,6 +495,7 @@ class MyRegistrySource(EvaluatorSource):
     async def list_evaluators(self) -> list[EvaluatorInfo]: ...
     async def fetch_evaluator(self, ref: str, dest: Path) -> Path: ...
 
+
 register_source(MyRegistrySource())
 ```
 

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/examples/README.md

@@ -69,10 +69,12 @@ For simple prompt-to-response agents, there's also a decorator shorthand:
 ```python
 app = AgentEvals(eval_set_id="my-eval")
 
+
 @app.agent
 def my_agent(prompt):
     return llm.invoke(prompt).content
 
+
 app.run(["Hello!", "Tell me a joke"])
 ```
 

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/examples/dice_agent/README.md

@@ -89,13 +89,8 @@ Add a new tool in `agent.py`:
 def roll_multiple(count: int, sides: int = 6) -> dict:
     """Roll multiple dice at once."""
     results = [random.randint(1, sides) for _ in range(count)]
-    return {
-        "count": count,
-        "sides": sides,
-        "results": results,
-        "total": sum(results),
-        "average": sum(results) / count
-    }
+    return {"count": count, "sides": sides, "results": results, "total": sum(results), "average": sum(results) / count}
+
 
 dice_agent = Agent(
     name="dice_agent",

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/examples/langchain_agent/README.md

@@ -145,7 +145,7 @@ os.environ["OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"] = "true"
 
 ```python
 tracer_provider = TracerProvider()  # For spans
-logger_provider = LoggerProvider()   # For logs
+logger_provider = LoggerProvider()  # For logs
 ```
 
 **Both are required** - spans provide metadata, logs provide message content.
@@ -164,10 +164,12 @@ The log processor shares the WebSocket connection from the span processor.
 ```python
 loop = asyncio.new_event_loop()
 
+
 def run_loop_in_background():
     asyncio.set_event_loop(loop)
     loop.run_forever()
 
+
 thread = threading.Thread(target=run_loop_in_background, daemon=True)
 thread.start()
 ```

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/packages/evaluator-sdk-py/README.md

@@ -15,6 +15,7 @@ pip install agentevals-evaluator-sdk
 ```python
 from agentevals_evaluator_sdk import evaluator, EvalInput, EvalResult
 
+
 @evaluator
 def my_evaluator(input: EvalInput) -> EvalResult:
     scores = []
@@ -27,6 +28,7 @@ def my_evaluator(input: EvalInput) -> EvalResult:
         per_invocation_scores=scores,
     )
 
+
 if __name__ == "__main__":
     my_evaluator.run()
 ```

{agentevals_cli-0.9.7 → agentevals_cli-0.9.9}/pyproject.toml

@@ -9,22 +9,36 @@ description = "Standalone framework to evaluate agent correctness based on porta
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-    "google-adk[eval]>=2.1.0,<2.2",
-    "click>=8.0",
+    "google-adk[eval]>=2.5.0,<3",
+    "click>=8.3.3",
     "tabulate>=0.9.0",
     "fastapi>=0.115.0",
     "uvicorn[standard]>=0.32.0",
-    "python-multipart>=0.0.12",
-    "python-dotenv>=1.0.0",
+    "python-multipart>=0.0.32",
+    "python-dotenv>=1.2.2",
     "opentelemetry-proto>=1.36.0",
     "pyyaml>=6.0",
     "httpx>=0.27.0",
+    # Security floors for CVE-affected transitive dependencies of the default install.
+    # None are imported directly, do not "clean up" as unused. pip does not read
+    # lockfiles, so installs from PyPI resolve from these floors alone.
+    "aiohttp>=3.14.3",
+    "authlib>=1.7.2",
+    "idna>=3.18",
+    "litellm>=1.85.7",
+    "nltk>=3.10.2",
+    "pyasn1>=0.6.4",
+    "pygments>=2.20.0",
+    "requests>=2.34.2",
+    "urllib3>=2.7.0",
 ]
 
 [project.optional-dependencies]
 live = [
-    "mcp>=1.26.0",
+    "mcp>=1.28.1,<2",
     "httpx>=0.27.0",
+    "pyjwt>=2.13.0",
+    "pydantic-settings>=2.15.0",
 ]
 streaming = [
     "opentelemetry-sdk>=1.20.0",
@@ -70,7 +84,7 @@ asyncio_mode = "auto"
 
 [dependency-groups]
 dev = [
-    "pytest>=9.0.2",
+    "pytest>=9.0.3",
     "pytest-asyncio>=0.24.0",
     "httpx>=0.27.0",
     "ruff>=0.11.0",