gossamer-web 0.9.0__tar.gz

gossamer_web-0.9.0/.coderadar.toml

@@ -0,0 +1,37 @@
+# CodeRadar project configuration
+# Generated by `coderadar init` on 2026-08-24T23:23:19.765004
+#
+# `coderadar analyze` prints a line naming any key it could not use, so a
+# stale or misspelled setting here will say so rather than sit silent.
+
+[project]
+# Narrow the walk to these subdirectories; omitted, the whole root is walked.
+# roots = ["src/", "tests/"]
+exclude = ["**/__pycache__/**", "**/.venv/**", "**/node_modules/**", "**/target/**", ".gossamer_cache/**"]
+
+[database]
+path = ".coderadar/store/coderadar.db"
+
+[embedding]
+# Index-time and query-time must name the same model: a dimension mismatch
+# produces confident nonsense rather than an error.
+model = "BAAI/bge-small-en-v1.5"
+dimension = 384
+batch_size = 32
+
+[watch]
+debounce_ms = 100
+max_file_size_bytes = 1048576
+
+[mutation]
+enabled = true
+default_dry_run = true
+allow = ["src/", "lib/", "tests/", "scripts/", "gossamer/"]
+deny = [".git/", ".coderadar/", "/migrations/", "/*.lock", "/generated/"]
+
+[resolution]
+min_confidence = 0.3
+
+[resolution.import_graph]
+max_import_depth = 3
+include_same_package = true

gossamer_web-0.9.0/.github/workflows/ci.yml

@@ -0,0 +1,120 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master, dev]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ['3.10', '3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-rust-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-rust-
+
+      - name: Create virtual environment
+        run: python -m venv .venv
+
+      # The maturin build backend is pulled in by pip's build isolation,
+      # so no separate maturin install or `maturin develop` step is needed.
+      # Installing the package via its metadata is what validates the
+      # runtime dependency declarations (P1).
+      - name: Install package with dependencies (Linux/macOS)
+        if: runner.os != 'Windows'
+        run: |
+          ./.venv/bin/pip install -e ".[mcp,documents]"
+          ./.venv/bin/pip install -r requirements.txt
+
+      - name: Install package with dependencies (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          .venv\Scripts\pip.exe install -e ".[mcp,documents]"
+          .venv\Scripts\pip.exe install -r requirements.txt
+
+      - name: Run tests (Linux/macOS)
+        if: runner.os != 'Windows'
+        run: ./.venv/bin/pytest tests/ -v --tb=short
+
+      - name: Run tests (Windows)
+        if: runner.os == 'Windows'
+        run: .venv\Scripts\pytest.exe tests/ -v --tb=short
+
+  supply-chain:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      # Audit the installed runtime + extra dependencies against the OSV
+      # vulnerability database. Given PyPI-targeting worm campaigns of the
+      # past year, this is a hard gate, not a warning.
+      - name: pip-audit
+        run: |
+          python -m venv /tmp/auditenv
+          # The runner-bundled pip is often itself advisory-flagged —
+          # upgrade it inside the venv so the audit covers our dependencies,
+          # not the runner image.
+          /tmp/auditenv/bin/pip install --quiet --upgrade pip
+          /tmp/auditenv/bin/pip install --quiet pip-audit
+          /tmp/auditenv/bin/pip install --quiet -e ".[mcp,documents]"
+          /tmp/auditenv/bin/pip-audit
+
+      # Audit the Rust dependency tree (Cargo.lock) against OSV — the same
+      # database pip-audit uses, which mirrors RustSec. Stdlib-only script,
+      # no cargo toolchain step (cargo-audit's crates.io release is stale and
+      # its prebuilt binaries are a moving target).
+      - name: cargo audit (OSV)
+        run: python scripts/audit_cargo.py
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Rust clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Install Python linting tools
+        run: pip install "ruff==0.16.4"
+
+      - name: Run ruff
+        run: ruff check gossamer/

gossamer_web-0.9.0/.github/workflows/release.yml

@@ -0,0 +1,160 @@
+name: Release
+
+# Publishing happens on version tag push (e.g. `git tag v0.9.0 && git push
+# origin v0.9.0`). The tag MUST match Cargo.toml/pyproject.toml — enforced
+# by the check-tag job below.
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+jobs:
+  check-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Tag matches package version
+        run: |
+          TAG="${GITHUB_REF#refs/tags/v}"
+          CARGO=$(grep '^version' Cargo.toml | head -1 | cut -d'"' -f2)
+          PYPROJ=$(grep '^version' pyproject.toml | head -1 | cut -d'"' -f2)
+          echo "tag=$TAG cargo=$CARGO pyproject=$PYPROJ"
+          [ "$TAG" = "$CARGO" ] && [ "$TAG" = "$PYPROJ" ] || {
+            echo "::error::tag v$TAG != Cargo.toml ($CARGO) / pyproject.toml ($PYPROJ)"
+            exit 1
+          }
+
+  build-wheels:
+    needs: check-tag
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        # Single interpreter per OS: pyo3 abi3-py38 makes one wheel per
+        # platform installable on every supported Python (>=3.10).
+        python-version: ['3.12']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # manylinux: auditwheel-repaired portable Linux wheels — plain
+      # `maturin build` emits linux_x86_64 wheels that PyPI REJECTS.
+      # (macOS/Windows need no equivalent; the flag is Linux-only.)
+      - name: Build wheel (Linux, manylinux)
+        if: runner.os == 'Linux'
+        uses: PyO3/maturin-action@v1
+        with:
+          command: build
+          args: --release --out dist
+          manylinux: auto
+
+      - name: Build wheel (macOS / Windows)
+        if: runner.os != 'Linux'
+        uses: PyO3/maturin-action@v1
+        with:
+          command: build
+          args: --release --out dist
+
+      - name: Upload wheel artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ runner.os }}
+          path: dist/*.whl
+
+  build-sdist:
+    needs: check-tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install maturin
+        run: pip install "maturin>=1.0,<2.0"
+
+      # Needs network: resolves the meta_oxide git dependency. sdist
+      # consumers rebuild from source, so this is expected.
+      - name: Build sdist
+        run: maturin sdist --out dist
+
+      - name: Upload sdist artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  publish:
+    needs: [build-wheels, build-sdist]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      contents: write    # GitHub Release
+      id-token: write    # PyPI Trusted Publishing (OIDC, no secret)
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          path: dist
+          merge-multiple: true
+
+      - name: Download sdist
+        uses: actions/download-artifact@v4
+        with:
+          name: sdist
+          path: dist
+
+      # A GitHub Release with the wheels is created for every tag, with or
+      # without PyPI credentials, so released versions are always
+      # downloadable and pinnable from GitHub.
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          generate_release_notes: true
+
+      - name: Check PyPI token
+        id: token
+        env:
+          TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          if [ -n "$TOKEN" ]; then echo "has=true" >> "$GITHUB_OUTPUT"; fi
+
+      # Preferred: Trusted Publishing (configure once on PyPI: project
+      # settings → trusted publisher = this repo + release.yml workflow).
+      # Falls back to PYPI_API_TOKEN when OIDC is unavailable.
+      - name: Publish to PyPI (trusted publishing)
+        id: oidc
+        continue-on-error: true
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Publish to PyPI (API token)
+        if: steps.oidc.outcome == 'failure' && steps.token.outputs.has == 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+
+      - name: Publish outcome
+        run: |
+          if [ "${{ steps.oidc.outcome }}" = "success" ]; then
+            echo "PyPI publish: trusted publishing OK"
+          elif [ "${{ steps.token.outputs.has }}" = "true" ]; then
+            echo "PyPI publish: API token path taken (check step above)"
+          else
+            echo "::notice::PyPI publish skipped — no trusted publisher and no PYPI_API_TOKEN secret. Wheels are on the GitHub Release."
+          fi

gossamer_web-0.9.0/.gitignore

@@ -0,0 +1,54 @@
+# CodeRadar index
+.coderadar/
+
+# Rust build artifacts
+/target/
+**/*.rs.bk
+
+# Python bytecode & caches
+__pycache__/
+*.py[cod]
+*$py.class
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+
+# Compiled extension (built via maturin; rebuild with `maturin develop`)
+*.so
+*.pyd
+# Windows debug symbols from the built extension (churns on every rebuild).
+*.pdb
+
+# Packaging
+build/
+dist/
+*.egg-info/
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Runtime caches
+.gossamer_cache/
+.web_research_cache/
+stored_documents/
+
+# Editors / OS
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db
+crash.log
+
+# Scratch artifacts
+step1_links.json
+wiki_topics.json
+
+# Windows device-name artifact (prevents accidental indexing)
+nul
+
+# Local planning spillover (audits, provider research, internal plans).
+# Deliberately unsynced: working notes live here, the repo keeps only
+# docs/QUICKREF.md + docs/ARCHITECTURE.md as its synced record.
+/planning/

gossamer_web-0.9.0/AGENTS.md

@@ -0,0 +1,23 @@
+# AGENTS.md — gossamer
+
+Web research toolkit (Python + Rust). For any task needing **current external
+information** (docs, APIs, papers, case law, market data, patents), use
+gossamer instead of guessing or raw curl loops.
+
+- **MCP** (if configured): 10 tools — `web_search`, `inspect_html_page`,
+  `batch_inspect_pages`, `extract_document`, `discover_resources`,
+  `crawl`, `manage_cache`, `research_by_category`,
+  `export_citations`, `check_sources`.
+- **CLI** (always available, mirrors all 10 MCP tools 1:1):
+  `gossamer search|research|categories|inspect|batch|extract|check|discover|crawl|cache|cite`
+  (or `python -m gossamer.cli …` from the project venv).
+- **Routing**: `gossamer categories` prints the live category → provider
+  table (`scholarly`/`legal`/`patent`/`financial`/`geo`). Patent providers
+  are key-gated — surface missing-key errors to the user, don't retry.
+- **Budgets**: keep crawls ≤ 15 pages, set `max_tokens`, extract page ranges.
+- **Keys**: `~/.gossamer/keys.json` (`python -m gossamer.keystore --init`);
+  never put secrets in configs or prompts.
+
+Dev: `.venv/Scripts/python.exe -m pytest -q` (full suite),
+`ruff check gossamer/`, `maturin develop --release` after touching `src/`.
+Target branch for changes: `dev`.