Declare direct dependencies flagged by ty missing-direct-dependency

[Sun Haoran (haoranpb)]

What

Fix ty missing-direct-dependency. Package code may only import project.dependencies or extras, so this PR touches manifests (unavoidable for this rule):

• Add packaging and rich to project.dependencies (previously only transitive).
• Move redteam from a dependency group to [project.optional-dependencies]. Install with uv sync --extra redteam; CI's setup-python-uv action now uses --all-groups --all-extras.
• Update CLI messages/help, CONTRIBUTING, .env.sample and tests accordingly.
• uv.lock: only the bcbench stanza changes.

Part of the stack that makes ty strict (all = "error") across the whole uv workspace. Each PR fixes one rule in Python code only; the config change lands in #956.

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/pytest

The overall line coverage in commit 29e8f9c in the ty/strict-direct-dep... branch remains at 86%, unchanged from commit c30246c in the ty/strict-redundant-... branch.

Show a line coverage summary of the most impacted files.

File	ty/strict-redundant-... c30246c	ty/strict-direct-dep... 29e8f9c	+/-
src/bcbench/eva...stgeneration.py	46%	41%	-5%
src/bcbench/col...t_codereview.py	89%	88%	-1%
src/bcbench/ope...p_operations.py	92%	91%	-1%
src/bcbench/ope...n_operations.py	88%	87%	-1%
src/bcbench/age...opilot/agent.py	74%	73%	-1%
src/bcbench/eva...view_parsing.py	70%	70%	0%
src/bcbench/types.py	91%	92%	+1%
src/bcbench/config.py	97%	98%	+1%
src/bcbench/age.../mcp_gateway.py	91%	92%	+1%
src/bcbench/age...t/shared/mcp.py	92%	95%	+3%

---

_{Updated October 08, 2026 11:36 UTC}

[Copilot]

🟡 Changes recommended

The development-container setup still omits --all-extras, unintentionally dropping previously installed red-team dependencies.

1 open finding

• Include extras in devcontainer dependency sync · New

What changed in this PR

Declares direct dependencies required by strict ty checks and converts red-team tooling into an optional extra.

Changes:

• Adds direct packaging and rich dependencies.
• Moves red-team dependencies to an optional extra.
• Updates installation workflows, CLI messaging, tests, and documentation.

File	Description
pyproject.toml	Updates dependency declarations.
uv.lock	Reflects manifest changes.
.github/​actions/​setup-python-uv/​action.yml	Adds full groups/extras installation.
.github/​workflows/​CI.yml	Enables full installation in CI.
.github/​workflows/​copilot-setup-steps.yml	Enables full Copilot setup.
src/​bcbench/​cli.py	Renames red-team availability handling.
src/​bcbench/​commands/​redteam.py	Updates installation guidance.
tests/​test_cli_commands.py	Updates helper tests.
tests/​test_redteam.py	Updates extra terminology.
CONTRIBUTING.md	Documents extras installation.
.env.sample	Updates red-team setup guidance.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟢 Approval recommended

The manifest, lockfile, workflows, tests, and user-facing instructions consistently implement the dependency changes.

0 open findings

1 resolved since last review

• Include extras in devcontainer dependency sync

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.