buysmarter 0.1.2__tar.gz

buysmarter-0.1.2/.env.example

@@ -0,0 +1,19 @@
+# Copy to .env and adjust as needed.
+
+DATABASE_URL=postgresql+asyncpg://buysmarter:buysmarter@localhost:5434/buysmarter
+REDIS_URL=redis://localhost:6380/0
+
+# LLM: primary provider is the local `claude` CLI through OmniRoute (the model
+# picks the combo; only opus/hard puts the Claude subscription first) — NO API key required. The keys below are an optional API fallback,
+# used only when you set DEFAULT_LLM_MODEL to a non-CLI model that has its key.
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+GEMINI_API_KEY=
+DEEPSEEK_API_KEY=
+
+# LLM adapter defaults. haiku/sonnet/opus route to the local `claude` CLI.
+DEFAULT_LLM_MODEL=sonnet
+PROMPT_VERSION=v1
+
+# Kaspi.kz source (optional; residential proxy for datacenter IPs Kaspi 429s).
+KASPI_PROXY=

buysmarter-0.1.2/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,28 @@
+name: Bug report
+description: Something broke or ranked wrong
+labels: [bug]
+body:
+  - type: textarea
+    id: command
+    attributes:
+      label: Command
+      description: The exact command or MCP call
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened and what you expected
+    validations:
+      required: true
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Output of `uv run buysmarter doctor`
+      render: text
+  - type: textarea
+    id: log
+    attributes:
+      label: Relevant lines from logs/buysmarter.log
+      render: text

buysmarter-0.1.2/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/octrow/buy-smarter/security/advisories/new
+    about: Report privately, not in a public issue

buysmarter-0.1.2/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,10 @@
+name: Feature or category request
+description: A new source, category or ranking signal
+labels: [enhancement]
+body:
+  - type: textarea
+    id: need
+    attributes:
+      label: What you want to buy or check, and what the report misses
+    validations:
+      required: true

buysmarter-0.1.2/.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown: { default-days: 7 }   # skip releases younger than a week (hijacked-release window)
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown: { default-days: 7 }
+    groups:
+      actions: { patterns: ["*"] }

buysmarter-0.1.2/.github/pull_request_template.md

@@ -0,0 +1,6 @@
+## What and why
+
+## Test plan
+
+- [ ] `make check` passes
+- [ ] README.md and README.ru.md updated together (if touched)

buysmarter-0.1.2/.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: buysmarter
+          POSTGRES_PASSWORD: buysmarter
+          POSTGRES_DB: buysmarter
+        ports: ["5434:5432"]
+        options: >-
+          --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - run: uv sync --locked
+      - run: uv run alembic upgrade head
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run pytest -q

buysmarter-0.1.2/.github/workflows/install.yml

@@ -0,0 +1,36 @@
+name: install
+on:
+  push:
+    branches: [main]
+    paths: [install.sh, install.ps1, pyproject.toml, uv.lock, "src/**", .github/workflows/install.yml]
+  pull_request:
+    paths: [install.sh, install.ps1, pyproject.toml, uv.lock, "src/**", .github/workflows/install.yml]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  install:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      INSTALL_SOURCE: ${{ github.workspace }}  # install this commit, not what is on GitHub
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - if: runner.os != 'Windows'
+        run: |
+          sh install.sh
+          ~/.local/bin/buysmarter --help
+          ~/.local/bin/buysmarter doctor
+      - if: runner.os == 'Windows'
+        shell: powershell  # Windows PowerShell 5.1, what the README one-liner runs
+        run: |
+          ./install.ps1
+          $bin = Join-Path (uv tool dir --bin) "buysmarter.exe"
+          & $bin --help; if ($LASTEXITCODE -ne 0) { exit 1 }
+          & $bin doctor; if ($LASTEXITCODE -ne 0) { exit 1 }

buysmarter-0.1.2/.github/workflows/release.yml

@@ -0,0 +1,79 @@
+# Tag vX.Y.Z → tests → wheel and sdist → PyPI (trusted publishing) → GitHub release with build provenance; install.sh/install.ps1 install that wheel.
+name: release
+on:
+  push:
+    tags: ["v*"]
+    branches: [main]
+    paths: [.github/workflows/release.yml]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          enable-cache: false  # no cache in a release workflow: a poisoned cache would ship in the artifacts
+      - name: tag must match the pyproject version (the installers derive the wheel name from the tag)
+        if: startsWith(github.ref, 'refs/tags/')
+        run: test "v$(uv version --short)" = "$GITHUB_REF_NAME"
+      - run: uv sync --locked && uv run pytest -q
+
+  build:
+    needs: check
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          enable-cache: false
+      - run: uv build
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+
+  pypi:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+
+  github-release:
+    needs: [build, pypi]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write      # create the release
+      id-token: write      # build provenance
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          path: dist/
+          merge-multiple: true
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+      - env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: gh release create "$TAG" dist/* --repo "$GITHUB_REPOSITORY" --generate-notes --verify-tag

buysmarter-0.1.2/.github/workflows/scorecard.yml

@@ -0,0 +1,30 @@
+# Copy to <repo>/.github/workflows/scorecard.yml (public repos). Results land in Security → Code scanning
+# and on https://scorecard.dev; badge for the README:
+# [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/octrow/buy-smarter/badge)](https://scorecard.dev/viewer/?uri=github.com/octrow/buy-smarter)
+# scorecard-action rejects workflows with top-level env/defaults or extra write permissions; keep this shape.
+name: scorecard
+on:
+  branch_protection_rule:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "29 4 * * 1"
+permissions: read-all
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write   # upload SARIF
+      id-token: write          # publish_results
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          sarif_file: results.sarif

buysmarter-0.1.2/.github/workflows/security.yml

@@ -0,0 +1,36 @@
+name: security
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 3 * * 1"
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write   # PR comments on a finding; drop it with GITLEAKS_ENABLE_COMMENTS=false
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+  zizmor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: pipx run zizmor==1.30.1 --min-severity medium .github/workflows

buysmarter-0.1.2/.gitignore

@@ -0,0 +1,28 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+
+# Virtual env
+.venv/
+venv/
+
+# Env / secrets
+.env
+.env.*
+!.env.example
+
+# Tooling caches
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+
+# Logs
+logs/
+*.log
+
+# Generated reports
+reports/

buysmarter-0.1.2/.gitleaks.toml

@@ -0,0 +1,6 @@
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Saved public marketplace responses used as parser fixtures"
+paths = ['''tests/samples/''']

buysmarter-0.1.2/.mcp.json

@@ -0,0 +1,13 @@
+{
+  "mcpServers": {
+    "buy-smarter": {
+      "command": "uv",
+      "args": [
+        "run",
+        "python",
+        "-m",
+        "buysmarter.mcp_server"
+      ]
+    }
+  }
+}

buysmarter-0.1.2/.pre-commit-config.yaml

@@ -0,0 +1,13 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks          # staged changes only; CI (security.yml) scans the whole history
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.30.1
+    hooks:
+      - id: zizmor            # workflow security: template injection, unpinned actions, pull_request_target
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint        # workflow syntax and shellcheck of run: steps

buysmarter-0.1.2/.python-version

@@ -0,0 +1 @@
+3.12

buysmarter-0.1.2/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versions follow [Semantic Versioning](https://semver.org/).
+
+## [0.1.2] - 2026-10-15
+
+### Added
+- Published on PyPI (`uvx buysmarter`) via trusted publishing; package metadata: license, authors, project URLs.
+
+## [0.1.1] - 2026-10-14
+
+### Changed
+- fastmcp 4.1 (MCP SDK v2): the MCP server answers both the handshake-era and the sessionless protocol; tools and
+  their schemas are unchanged.
+- Reports go to `~/.local/share/buysmarter/reports/` and logs to `~/.cache/buysmarter/logs/`, not to the folder the
+  command runs in.
+
+### Security
+- pyjwt 2.15.1, cryptography 50.0.2 and mako 1.4.3 close the open advisories (1 critical, 6 high).
+
+### Dependencies
+- pydantic 2.13.5, pydantic-settings 2.15.0, fastapi 0.142.2, asyncpg 0.32.0.
+
+## [0.1.0] - 2026-10-14
+
+First release.
+
+### Added
+- `recommend`: a request in plain words → offers from Kaspi.kz, Ozon.kz and OLX.kz (used) ranked for budget, city
+  and required features, with a score per axis (brand or ingredient, price with a 30-day trend, reviews, specs,
+  popularity, availability) and a markdown report.
+- Review trust: five-star share over the full distribution, review bursts, junk texts and defect complaints
+  discount the reviews axis; required features are checked against verbatim review quotes.
+- Brand and model knowledge per category (`learn-category`, `learn`), seeded for water flossers.
+- Smartphones: Kimovil index and phone specs in the specs axis.
+- OLX used listings: defects the seller admits to are listed as cons; ads sold for parts are dropped.
+- Price history (`refresh`, `history`) in Postgres; everything else works without it.
+- MCP server for Claude over the same services.
+- `doctor`: what is missing and what that turns off.
+- One-command installers for Linux, macOS (`install.sh`) and Windows (`install.ps1`); settings also read
+  `~/.config/buysmarter/.env`.

buysmarter-0.1.2/CODE_OF_CONDUCT.md

@@ -0,0 +1,6 @@
+# Code of conduct
+
+This project follows the [Contributor Covenant 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+Report unacceptable behavior privately through
+[GitHub security advisories](https://github.com/octrow/buy-smarter/security/advisories/new) or to the maintainer's
+GitHub profile email.

buysmarter-0.1.2/CODE_OF_CONDUCT.ru.md

@@ -0,0 +1,6 @@
+# Кодекс поведения
+
+Проект следует [Contributor Covenant 2.1](https://www.contributor-covenant.org/ru/version/2/1/code_of_conduct/).
+О недопустимом поведении сообщайте приватно через
+[GitHub security advisories](https://github.com/octrow/buy-smarter/security/advisories/new) или на почту из
+GitHub-профиля мейнтейнера.

buysmarter-0.1.2/CONTRIBUTING.md

@@ -0,0 +1,26 @@
+**English** | **[Русский](CONTRIBUTING.ru.md)**
+
+# Contributing
+
+Bug reports, new categories of brand knowledge and source fixes are welcome.
+
+## Setup
+
+```bash
+uv sync
+make check   # ruff check + ruff format --check + pytest
+```
+
+Tests need no network. Database tests run when Postgres is up (`make up && uv run alembic upgrade head`)
+and are skipped otherwise.
+
+## Pull requests
+
+- One change per PR, with a test that fails without it.
+- Parser changes come with a saved response in `tests/samples/` (strip personal data first).
+- Commit messages: `<type>: <description>`, where type is one of feat, fix, refactor, docs, test, chore, perf, ci.
+- Marketplace adapters live in [market-sources](https://github.com/octrow/market-sources); a broken
+  Kaspi/Ozon/OLX parser is usually fixed there.
+- Changes to `README.md` go into `README.ru.md` too, and the other way round.
+
+Be polite to the marketplaces: keep request pacing as it is and don't add bulk crawling.

buysmarter-0.1.2/CONTRIBUTING.ru.md

@@ -0,0 +1,26 @@
+**[English](CONTRIBUTING.md)** | **Русский**
+
+# Как помочь проекту
+
+Приветствуются баг-репорты, знания о брендах для новых категорий и починка источников.
+
+## Подготовка
+
+```bash
+uv sync
+make check   # ruff check + ruff format --check + pytest
+```
+
+Тестам сеть не нужна. Тесты базы запускаются, когда поднят Postgres (`make up && uv run alembic upgrade head`),
+иначе пропускаются.
+
+## Pull request
+
+- Одно изменение на PR и тест, который без него падает.
+- Изменения парсера идут вместе с сохранённым ответом в `tests/samples/` (без персональных данных).
+- Сообщения коммитов: `<type>: <description>`, где type — feat, fix, refactor, docs, test, chore, perf или ci.
+- Адаптеры площадок живут в [market-sources](https://github.com/octrow/market-sources); сломанный парсер
+  Kaspi/Ozon/OLX обычно чинится там.
+- Изменения в `README.md` дублируются в `README.ru.md`, и наоборот.
+
+Бережно относитесь к площадкам: не ускоряйте запросы и не добавляйте массовый обход.

buysmarter-0.1.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniil Petrov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

buysmarter-0.1.2/Makefile

@@ -0,0 +1,15 @@
+.PHONY: up down check test
+
+up:
+	docker compose up -d
+
+down:
+	docker compose down
+
+check:
+	uv run ruff check .
+	uv run ruff format --check .
+	uv run pytest
+
+test:
+	uv run pytest