ct-toolkit 0.5.0__tar.gz → 0.5.2__tar.gz

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ct-toolkit
-Version: 0.5.0
+Version: 0.5.2
 Summary: Computational Theseus Toolkit — Identity Continuity Guardrails for Agentic Systems
 Author: Hakan Damar
 License: Apache-2.0
@@ -33,7 +33,7 @@ Requires-Dist: uvicorn>=0.29.0
 Provides-Extra: server
 Provides-Extra: cli
 Provides-Extra: observability
-Requires-Dist: opentelemetry-api>=1.25.0; extra == "observability"
+Requires-Dist: opentelemetry-api>=1.45.2; extra == "observability"
 Requires-Dist: opentelemetry-sdk>=1.25.0; extra == "observability"
 Requires-Dist: langsmith>=0.8.18; extra == "observability"
 Provides-Extra: structured
@@ -157,7 +157,7 @@ $ ct-toolkit status
     | |  | |  | | |____ ____) | |____| |__| |____) | | |__| | |__| |/ ____ \| | \ \| |__| |
     |_|  |_|  |_|______|_____/|______|_____/|_____/   \_____|\____//_/    \_\_|  \_\_____/ 
 
-  Computational Theseus Toolkit (CT Toolkit) v0.5.0
+  Computational Theseus Toolkit (CT Toolkit) v0.5.2
   Identity Continuity Guardrails for Agentic Systems
 
 ╭──────────────────── CT Toolkit Audit & Telemetry Status ─────────────────────╮
@@ -249,9 +249,9 @@ For Deep Agents workflows, see [**ct-toolkit-deep-agents**](https://github.com/h
 
 | Metric           | Status                                                                                                                                                                                                              |
 | :--------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **Tests**        | ✅ 617 passed, 13 skipped                                                                                                                                                                                           |
+| **Tests**        | ✅ 635 passed, 13 skipped                                                                                                                                                                                           |
 | **Downloads**    | [![PyPI Downloads](https://static.pepy.tech/personalized-badge/ct-toolkit?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=MAGENTA&left_text=downloads)](https://pepy.tech/projects/ct-toolkit) |
-| **Last Phase**   | ✅ v0.5.0: provenance ledger of all proxied traffic, graded divergence scoring, paged dashboard tables                                                                              |
+| **Last Phase**   | ✅ v0.5.2: security fix for OpenTelemetry API (GHSA-mf5v-w3w3-f6cg), dependencies updated to 1.45.2                                                                             |
 
 ### Framework & Model Support
 

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/README.md

@@ -90,7 +90,7 @@ $ ct-toolkit status
     | |  | |  | | |____ ____) | |____| |__| |____) | | |__| | |__| |/ ____ \| | \ \| |__| |
     |_|  |_|  |_|______|_____/|______|_____/|_____/   \_____|\____//_/    \_\_|  \_\_____/ 
 
-  Computational Theseus Toolkit (CT Toolkit) v0.5.0
+  Computational Theseus Toolkit (CT Toolkit) v0.5.2
   Identity Continuity Guardrails for Agentic Systems
 
 ╭──────────────────── CT Toolkit Audit & Telemetry Status ─────────────────────╮
@@ -182,9 +182,9 @@ For Deep Agents workflows, see [**ct-toolkit-deep-agents**](https://github.com/h
 
 | Metric           | Status                                                                                                                                                                                                              |
 | :--------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **Tests**        | ✅ 617 passed, 13 skipped                                                                                                                                                                                           |
+| **Tests**        | ✅ 635 passed, 13 skipped                                                                                                                                                                                           |
 | **Downloads**    | [![PyPI Downloads](https://static.pepy.tech/personalized-badge/ct-toolkit?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=MAGENTA&left_text=downloads)](https://pepy.tech/projects/ct-toolkit) |
-| **Last Phase**   | ✅ v0.5.0: provenance ledger of all proxied traffic, graded divergence scoring, paged dashboard tables                                                                              |
+| **Last Phase**   | ✅ v0.5.2: security fix for OpenTelemetry API (GHSA-mf5v-w3w3-f6cg), dependencies updated to 1.45.2                                                                             |
 
 ### Framework & Model Support
 

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/ct_toolkit/__init__.py

@@ -23,7 +23,7 @@ from ct_toolkit.core.exceptions import (
     ChainIntegrityError,
 )
 
-__version__ = "0.5.0"
+__version__ = "0.5.2"
 
 __all__ = [
     "TheseusWrapper",

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/ct_toolkit/core/tool_guard.py

@@ -110,12 +110,14 @@ RISKY_PATTERNS: tuple[tuple[Finding, re.Pattern[str]], ...] = (
 
 _NORMALIZE_STRIP = re.compile(r"[\"'\\]")
 _URL_HOST = re.compile(r"[a-z][a-z0-9+.\-]*://(?:[^/\s@\"'\\]*@)?([^/\s:\"'\\?#]+)", re.IGNORECASE)
+_SCP_HOST = re.compile(r"(?<![\w.%+-])[\w.-]+@([a-z0-9][a-z0-9.-]*\.[a-z]{2,}):(?=[\w~/.])", re.IGNORECASE)
 _IPV4 = re.compile(r"(?<![\d.])(?:\d{1,3}\.){3}\d{1,3}(?![\d.])")
 
 
 def extract_hosts(text: str) -> set[str]:
-    """Lowercased hosts of `scheme://` URLs and bare IPv4 literals in `text`."""
+    """Lowercased hosts of `scheme://` URLs, `user@host:path` remotes and bare IPv4 literals in `text`."""
     hosts = {match.group(1).lower() for match in _URL_HOST.finditer(text)}
+    hosts.update(match.group(1).lower() for match in _SCP_HOST.finditer(text))
     for address in _IPV4.findall(text):
         if all(int(octet) <= 255 for octet in address.split(".")):
             hosts.add(address)
@@ -135,15 +137,44 @@ def declared_tools(tools: Optional[Iterable[Any]]) -> set[str]:
     return names
 
 
+# Text that the user and the harness wrote is trusted to name hosts. What the model wrote, and what tools returned
+# (web pages, files, command output), is not: an injected instruction names the attacker's host in exactly that text.
+UNTRUSTED_ROLES = ("assistant", "tool", "function")
+UNTRUSTED_ITEM_TYPES = ("function_call", "function_call_output")
+UNTRUSTED_BLOCK_TYPES = ("tool_use", "tool_result", "function_call", "function_call_output")
+
+
+def trusted_request(request: dict) -> dict:
+    """A copy of a Chat Completions, Messages or Responses request without the model's own turns and the tool
+    results. System prompt, user text and tool declarations stay."""
+    result = dict(request)
+    for key in ("messages", "input"):
+        items = result.get(key)
+        if not isinstance(items, list):
+            continue
+        kept = []
+        for item in items:
+            if not isinstance(item, dict) or item.get("role") in UNTRUSTED_ROLES or item.get("type") in UNTRUSTED_ITEM_TYPES:
+                continue
+            content = item.get("content")
+            if isinstance(content, list):
+                item = {**item, "content": [b for b in content if not (isinstance(b, dict) and b.get("type") in UNTRUSTED_BLOCK_TYPES)]}
+            kept.append(item)
+        result[key] = kept
+    return result
+
+
 def conversation_text(message: str, history: Optional[Sequence[Any]] = None, system: Optional[str] = None) -> str:
-    """Everything the request shows the model, except the model's own earlier turns."""
+    """Everything the request shows the model, except the model's own earlier turns and tool results."""
     parts = [system or "", message or ""]
     for item in history or []:
-        if not isinstance(item, dict) or item.get("role") == "assistant":
+        if not isinstance(item, dict) or item.get("role") in UNTRUSTED_ROLES:
             continue
         content = item.get("content")
         if isinstance(content, str):
             parts.append(content)
+        elif isinstance(content, list):
+            parts.extend(b["text"] for b in content if isinstance(b, dict) and isinstance(b.get("text"), str))
     return "\n".join(parts)
 
 
@@ -416,6 +447,9 @@ def without_stream_calls(chunk: Any, blocked_keys: set[int], calls_left: int) ->
         calls = _field(delta, "tool_calls")
         if isinstance(calls, list) and calls:
             calls[:] = [call for call in calls if (_field(call, "index") or 0) not in blocked_keys]
+            for call in calls:  # clients place calls by index: the ones after a removed call move up
+                index = _field(call, "index") or 0
+                _set_field(call, "index", index - sum(1 for key in blocked_keys if key < index))
         if _field(choice, "finish_reason") == "tool_calls" and calls_left == 0:
             _set_field(choice, "finish_reason", "stop")
     return result
@@ -487,6 +521,12 @@ class ToolGuard:
         return tuple(findings)
 
     def _known_host(self, host: str, context: str) -> bool:
-        if host in context:
+        if _mentions_host(context, host):
             return True
         return any(host == allowed or host.endswith("." + allowed) for allowed in self.allowed_hosts)
+
+
+def _mentions_host(text: str, host: str) -> bool:
+    """Whether `text` names `host` as a whole: `ample.com` is not named by `example.com`, nor `example.com` by
+    `example.com.evil.test`."""
+    return re.search(rf"(?<![a-z0-9.-]){re.escape(host)}(?![a-z0-9-]|\.[a-z0-9])", text) is not None

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/ct_toolkit/provenance/log.py

@@ -78,6 +78,8 @@ LEDGER_SORT = {
 FULL_VERIFY_INTERVAL_S = 300.0
 GENERATION_COUNTER = "meta:generation"  # bumped by every write and rollback: a cache key for readers
 DERIVED_MARKER = "meta:derived"
+# Set once the `event_type` column is filled for old entries. 0.5.0 filled the other derived columns but not this one.
+EVENT_TYPE_MARKER = "meta:event_type"
 _ADD_COUNTER = (
     "INSERT INTO provenance_counters (name, value) VALUES (:name, :value) "
     "ON CONFLICT (name) DO UPDATE SET value = provenance_counters.value + excluded.value"
@@ -427,18 +429,29 @@ class ProvenanceLog:
                 self._backfill_derived(run)
                 self._rebuild_counters(run)
                 run(_ADD_COUNTER, {"name": DERIVED_MARKER, "value": 1.0})
+            if not run(f"SELECT name FROM provenance_counters WHERE name = '{EVENT_TYPE_MARKER}'"):
+                self._backfill_event_type(run)
+                run(_ADD_COUNTER, {"name": EVENT_TYPE_MARKER, "value": 1.0})
 
     def _backfill_derived(self, run: Any) -> None:
         for row_id, meta_raw in run("SELECT id, metadata FROM provenance"):
             metadata = json.loads(meta_raw) if isinstance(meta_raw, str) else dict(meta_raw)
             run(
-                "UPDATE provenance SET event = :event, verdict = :verdict, tool = :tool, mode = :mode WHERE id = :id",
+                "UPDATE provenance SET event = :event, verdict = :verdict, tool = :tool, mode = :mode, event_type = :event_type "
+                "WHERE id = :id",
                 {**self._derived(metadata), "id": row_id},
             )
 
+    def _backfill_event_type(self, run: Any) -> None:
+        for row_id, meta_raw in run("SELECT id, metadata FROM provenance WHERE event_type IS NULL"):
+            metadata = json.loads(meta_raw) if isinstance(meta_raw, str) else dict(meta_raw)
+            if metadata.get("event_type") is not None:
+                run("UPDATE provenance SET event_type = :event_type WHERE id = :id",
+                    {"event_type": str(metadata["event_type"]), "id": row_id})
+
     def _rebuild_counters(self, run: Any) -> None:
         """Recomputes the tool-call counters from the active entries. Used on migration and after a rollback."""
-        run(f"DELETE FROM provenance_counters WHERE name NOT IN ('{DERIVED_MARKER}', '{GENERATION_COUNTER}')")
+        run(f"DELETE FROM provenance_counters WHERE name NOT IN ('{DERIVED_MARKER}', '{EVENT_TYPE_MARKER}', '{GENERATION_COUNTER}')")
         totals: dict[str, float] = {}
         for (meta_raw,) in run("SELECT metadata FROM provenance WHERE status = 'active' AND event = :event",
                                {"event": TOOL_CALL_EVENT}):

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/ct_toolkit/proxy.py

@@ -27,12 +27,12 @@ from typing import Any, Optional
 
 import httpx
 from starlette.applications import Starlette
-from starlette.background import BackgroundTask
+from starlette.background import BackgroundTask, BackgroundTasks
 from starlette.requests import Request
 from starlette.responses import JSONResponse, Response, StreamingResponse
 from starlette.routing import Route
 
-from ct_toolkit.core.tool_guard import ToolCallDecision, ToolGuard, ToolGuardMode, tool_calls_of, without_calls
+from ct_toolkit.core.tool_guard import ToolCallDecision, ToolGuard, ToolGuardMode, tool_calls_of, trusted_request, without_calls
 from ct_toolkit.core.tool_guard_settings import SettingsWatcher, apply_to_guard
 from ct_toolkit.provenance.log import API_CALL_EVENT, MODEL_TURN_EVENT, ProvenanceLog
 from ct_toolkit.utils.logger import get_logger
@@ -45,12 +45,10 @@ SKIP_RESPONSE = {"content-length", "content-encoding", "transfer-encoding", "con
 
 
 def request_context(request: dict) -> tuple[str, str]:
-    """(conversation, task) for a model-turn request. The conversation is everything but the model's own turns;
-    the task is the user's own text."""
-    context = dict(request)
-    if isinstance(context.get("messages"), list):
-        context["messages"] = [m for m in context["messages"] if not (isinstance(m, dict) and m.get("role") == "assistant")]
-    conversation = json.dumps(context, ensure_ascii=False)
+    """(conversation, task) for a model-turn request. The conversation is what the user and the harness wrote: the
+    model's own turns and the tool results are left out, because injected instructions arrive in them; the task is
+    the user's own text."""
+    conversation = json.dumps(trusted_request(request), ensure_ascii=False)
     if isinstance(request.get("input"), str):  # Responses API, plain text input
         return conversation, request["input"]
     task_parts = []
@@ -260,13 +258,23 @@ def _drop_blocked(name: str, lines: list[str], data: Any, blocked: Blocked, call
         return lines
     kind = data.get("type")
     changed = False
-    if kind in ("content_block_start", "content_block_delta", "content_block_stop") and data.get("index") in blocked.anthropic:
-        return None
+    if kind in ("content_block_start", "content_block_delta", "content_block_stop") and isinstance(data.get("index"), int):
+        if data["index"] in blocked.anthropic:
+            return None
+        shift = sum(1 for index in blocked.anthropic if index < data["index"])
+        if shift:  # clients place blocks by index, so the blocks after a removed one move up
+            data["index"] -= shift
+            changed = True
     if kind in ("response.output_item.added", "response.output_item.done") and (data.get("item") or {}).get("type") == "function_call":
         if data.get("output_index") in blocked.responses:
             return None
     if kind in ("response.function_call_arguments.delta", "response.function_call_arguments.done") and data.get("output_index") in blocked.responses:
         return None
+    if isinstance(data.get("output_index"), int) and kind and kind.startswith("response."):
+        shift = sum(1 for index in blocked.responses if index < data["output_index"])
+        if shift:
+            data["output_index"] -= shift
+            changed = True
     if kind == "response.completed" and isinstance(data.get("response"), dict):
         output = data["response"].get("output")
         if isinstance(output, list):
@@ -285,6 +293,11 @@ def _drop_blocked(name: str, lines: list[str], data: Any, blocked: Blocked, call
             kept_calls = [call for call in calls if call.get("index", 0) not in blocked.openai]
             if len(kept_calls) != len(calls):
                 changed = True
+            for call in kept_calls:
+                shift = sum(1 for index in blocked.openai if index < call.get("index", 0))
+                if shift:
+                    call["index"] = call.get("index", 0) - shift
+                    changed = True
             if kept_calls:
                 delta["tool_calls"] = kept_calls
             else:
@@ -421,9 +434,14 @@ def create_app(
         if is_sse:
             if guard.mode is ToolGuardMode.ENFORCE:
                 stream = _enforced_stream(upstream_response, request_json, reviewer, endpoint)
-            else:
-                stream = _observed_stream(upstream_response, request_json, reviewer, endpoint)
-            return StreamingResponse(stream, status, response_headers, background=close)
+                return StreamingResponse(stream, status, response_headers, background=close)
+            # Observe mode forwards the stream as it comes; the verdicts are recorded once the body has been sent,
+            # so a slow judge never holds the stream open.
+            observed = _ObservedStream(upstream_response, request_json, reviewer, endpoint)
+            tasks = BackgroundTasks()
+            tasks.add_task(upstream_response.aclose)
+            tasks.add_task(observed.record)
+            return StreamingResponse(observed.forward(), status, response_headers, background=tasks)
 
         data = await upstream_response.aread()
         await upstream_response.aclose()
@@ -450,16 +468,32 @@ def create_app(
     return Starlette(routes=[Route("/{path:path}", forward, methods=METHODS)], lifespan=lifespan)
 
 
-async def _observed_stream(upstream_response: httpx.Response, request: dict, reviewer: ProxyReviewer, endpoint: str) -> AsyncIterator[bytes]:
-    """Forwards the stream line by line as it arrives, then records the verdicts and the turn when it ends."""
-    rebuilt = StreamToolCalls()
-    async for line in upstream_response.aiter_lines():
-        rebuilt.feed(line)
-        yield (line + "\n").encode()
-    await asyncio.to_thread(reviewer.review, request, rebuilt.response(), endpoint)
-    await asyncio.to_thread(
-        reviewer.record_turn, request, rebuilt.response(), rebuilt.text(), rebuilt.finish, endpoint, upstream_response.status_code
-    )
+class _ObservedStream:
+    """Observe mode: `forward` passes the stream on line by line; `record` reviews what was seen and writes the
+    verdicts and the turn to the provenance chain."""
+
+    def __init__(self, upstream_response: httpx.Response, request: dict, reviewer: ProxyReviewer, endpoint: str) -> None:
+        self._upstream = upstream_response
+        self._request = request
+        self._reviewer = reviewer
+        self._endpoint = endpoint
+        self._rebuilt = StreamToolCalls()
+        self._complete = False
+
+    async def forward(self) -> AsyncIterator[bytes]:
+        async for line in self._upstream.aiter_lines():
+            self._rebuilt.feed(line)
+            yield (line + "\n").encode()
+        self._complete = True
+
+    async def record(self) -> None:
+        if not self._complete:
+            return
+        rebuilt = self._rebuilt
+        await asyncio.to_thread(self._reviewer.review, self._request, rebuilt.response(), self._endpoint)
+        await asyncio.to_thread(
+            self._reviewer.record_turn, self._request, rebuilt.response(), rebuilt.text(), rebuilt.finish, self._endpoint, self._upstream.status_code
+        )
 
 
 async def _enforced_stream(upstream_response: httpx.Response, request: dict, reviewer: ProxyReviewer, endpoint: str) -> AsyncIterator[bytes]:

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/ct_toolkit/server.py

@@ -129,6 +129,33 @@ app = FastAPI(
     version="1.0.0"
 )
 
+
+# Host header names a client may use to reach a server that has no API key. "testserver" is the TestClient's.
+_LOOPBACK_HOST_HEADERS = _LOOPBACK_HOSTS | {"testserver"}
+
+
+def _host_header_name(value: str) -> str:
+    """The host name in a Host header, without the port: `localhost:8000` -> `localhost`, `[::1]:8000` -> `::1`."""
+    value = value.strip().lower()
+    if value.startswith("["):
+        return value[1:].split("]", 1)[0]
+    return value.rsplit(":", 1)[0] if value.count(":") == 1 else value
+
+
+@app.middleware("http")
+async def _reject_foreign_host_header(request: Request, call_next):
+    """Without an API key the server trusts loopback clients. A page on another site can reach a loopback server
+    too, by pointing its own domain at 127.0.0.1 (DNS rebinding), but the browser then sends that domain in the
+    Host header. Such requests are refused."""
+    if not (_server_api_key or os.environ.get("CT_SERVER_API_KEY")):
+        host = request.headers.get("host")
+        if host and _host_header_name(host) not in _LOOPBACK_HOST_HEADERS:
+            return JSONResponse(
+                status_code=403,
+                content={"detail": "Forbidden: without CT_SERVER_API_KEY the server answers only to localhost host names."},
+            )
+    return await call_next(request)
+
 class GuardrailRequest(BaseModel):
     """LiteLLM Generic Guardrail API Request Schema."""
     texts: Optional[List[str]] = Field(None, description="Extracted text from the request.")

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/ct_toolkit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ct-toolkit
-Version: 0.5.0
+Version: 0.5.2
 Summary: Computational Theseus Toolkit — Identity Continuity Guardrails for Agentic Systems
 Author: Hakan Damar
 License: Apache-2.0
@@ -33,7 +33,7 @@ Requires-Dist: uvicorn>=0.29.0
 Provides-Extra: server
 Provides-Extra: cli
 Provides-Extra: observability
-Requires-Dist: opentelemetry-api>=1.25.0; extra == "observability"
+Requires-Dist: opentelemetry-api>=1.45.2; extra == "observability"
 Requires-Dist: opentelemetry-sdk>=1.25.0; extra == "observability"
 Requires-Dist: langsmith>=0.8.18; extra == "observability"
 Provides-Extra: structured
@@ -157,7 +157,7 @@ $ ct-toolkit status
     | |  | |  | | |____ ____) | |____| |__| |____) | | |__| | |__| |/ ____ \| | \ \| |__| |
     |_|  |_|  |_|______|_____/|______|_____/|_____/   \_____|\____//_/    \_\_|  \_\_____/ 
 
-  Computational Theseus Toolkit (CT Toolkit) v0.5.0
+  Computational Theseus Toolkit (CT Toolkit) v0.5.2
   Identity Continuity Guardrails for Agentic Systems
 
 ╭──────────────────── CT Toolkit Audit & Telemetry Status ─────────────────────╮
@@ -249,9 +249,9 @@ For Deep Agents workflows, see [**ct-toolkit-deep-agents**](https://github.com/h
 
 | Metric           | Status                                                                                                                                                                                                              |
 | :--------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **Tests**        | ✅ 617 passed, 13 skipped                                                                                                                                                                                           |
+| **Tests**        | ✅ 635 passed, 13 skipped                                                                                                                                                                                           |
 | **Downloads**    | [![PyPI Downloads](https://static.pepy.tech/personalized-badge/ct-toolkit?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLACK&right_color=MAGENTA&left_text=downloads)](https://pepy.tech/projects/ct-toolkit) |
-| **Last Phase**   | ✅ v0.5.0: provenance ledger of all proxied traffic, graded divergence scoring, paged dashboard tables                                                                              |
+| **Last Phase**   | ✅ v0.5.2: security fix for OpenTelemetry API (GHSA-mf5v-w3w3-f6cg), dependencies updated to 1.45.2                                                                             |
 
 ### Framework & Model Support
 

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/ct_toolkit.egg-info/requires.txt

@@ -46,7 +46,7 @@ torch>=2.13.0
 fastembed>=0.3.0
 
 [observability]
-opentelemetry-api>=1.25.0
+opentelemetry-api>=1.45.2
 opentelemetry-sdk>=1.25.0
 langsmith>=0.8.18
 

{ct_toolkit-0.5.0 → ct_toolkit-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ct-toolkit"
-version = "0.5.0"
+version = "0.5.2"
 description = "Computational Theseus Toolkit — Identity Continuity Guardrails for Agentic Systems"
 readme = "README.md"
 requires-python = ">=3.11, <3.14"
@@ -44,7 +44,7 @@ Issues = "https://github.com/Theseus-Guard/ct-toolkit/issues"
 server = []
 cli = []
 observability = [
-    "opentelemetry-api>=1.25.0",
+    "opentelemetry-api>=1.45.2",
     "opentelemetry-sdk>=1.25.0",
     "langsmith>=0.8.18", # Fix: TracingMiddleware arbitrary file read (GHSA-f4xh-w4cj-qxq8, Dependabot #42)
 ]