patent-checker 0.5.0__tar.gz

patent_checker-0.5.0/.dockerignore

@@ -0,0 +1,39 @@
+# Build-context exclusions.
+#
+# What must NOT be listed here, because hatchling needs it to build the
+# wheel the image installs: README.md, LICENSE, pyproject.toml, uv.lock,
+# patent_checker/ and skills/.
+
+# Recipes and VCS metadata: BuildKit receives the Dockerfile out of band, and
+# a copied .git would both bloat the context and bake history into a layer.
+.git
+.gitignore
+.dockerignore
+Dockerfile
+compose.yaml
+
+# Local state and credentials must never reach a layer, not even a discarded
+# builder one.
+.venv
+.env
+.env.*
+secrets/
+.patent-checker/
+
+# Developer-only material: not part of the shipped package.
+PROJECT.md
+開発資料/
+tests/
+tools/
+.github/
+install.sh
+install.ps1
+
+# Caches and build outputs: host artefacts, rebuilt inside the image anyway.
+.pytest_cache
+.ruff_cache
+__pycache__
+**/__pycache__
+dist/
+build/
+*.egg-info

patent_checker-0.5.0/.env.example

@@ -0,0 +1,68 @@
+# Copy this file to .env and fill in your own credentials.
+# Never commit .env; secrets must not appear in the repository, logs, or docs.
+
+# EPO OPS consumer credentials (register at https://developers.epo.org/,
+# then My Apps -> add an app to obtain the key/secret pair).
+PATENT_CHECKER_OPS_KEY=
+PATENT_CHECKER_OPS_SECRET=
+
+# Optional: data directory (search cache, request log; the CLI also keeps
+# its exploration artifacts here). Defaults to ./.patent-checker for the CLI
+# and to the per-user data directory for the MCP server. When set, the
+# shared document cache is placed under it too (<dir>/cache) unless
+# PATENT_CHECKER_CACHE_DIR is also set.
+# PATENT_CHECKER_DATA_DIR=
+
+# Optional: shared document cache (biblio, claims, legal status, family,
+# Google Patents pages), reused across projects and by the CLI and the
+# server alike. Defaults to <per-user data dir>/cache, e.g.
+# ~/.local/share/patent-checker/cache (Linux/macOS) or
+# %LOCALAPPDATA%\patent-checker\cache (Windows).
+# PATENT_CHECKER_CACHE_DIR=
+
+# Optional: per-kind cache expiry overrides, comma-separated kind=ttl.
+# Kinds: biblio, claims, legal, family, gp, search, searchbib. A ttl is
+# <n>d (days), <n>h (hours) or 0 (never expires). Defaults: biblio=90d,
+# claims=0, legal=7d, family=30d, gp=0, search=1d, searchbib=1d. An
+# invalid value is a configuration error (no silent fallback).
+# PATENT_CHECKER_CACHE_TTL=legal=3d,family=14d
+
+# MCP server settings (patent-checker serve). The server refuses to start
+# until the operator notice has been read and acknowledged: run
+# `patent-checker serve --show-operator-notice` (add `--lang ja` for the
+# Japanese version), then set this to the version number shown there
+# (currently 1.0).
+PATENT_CHECKER_OPERATOR_CONSENT=
+
+# Note for docker compose users: compose.yaml does not read this file for
+# the container. It takes the OPS credentials and the bearer token from the
+# files under secrets/ (see secrets/README.md) and reads only
+# PATENT_CHECKER_OPERATOR_CONSENT (and optionally PATENT_CHECKER_IMAGE,
+# PATENT_CHECKER_PORT, PATENT_CHECKER_LOG_LEVEL) from a .env next to it.
+
+# Bearer token required by the http transport (not used by stdio). Supply
+# either the value directly or a file path via the _FILE variant; exactly
+# one of the two may be set. Generate a token with:
+#   python -c "import secrets; print(secrets.token_urlsafe(32))"
+PATENT_CHECKER_SERVER_TOKEN=
+# PATENT_CHECKER_SERVER_TOKEN_FILE=
+
+# Optional: interface/port to bind (http transport). Defaults to
+# 127.0.0.1:8642.
+# PATENT_CHECKER_SERVER_HOST=
+# PATENT_CHECKER_SERVER_PORT=8642
+
+# Required when PATENT_CHECKER_SERVER_HOST is not a loopback address:
+# comma-separated hostnames clients will use in the Host header. TLS must
+# then be provided by a reverse proxy in front of the server.
+# PATENT_CHECKER_SERVER_ALLOWED_HOSTS=
+
+# Optional: server log level (debug, info, warning, error; default info).
+# All server logs, including the access log, go to standard error.
+# PATENT_CHECKER_LOG_LEVEL=info
+
+# Optional: rate limit on incoming MCP requests (a guard against runaway
+# agent loops; upstream OPS/Google Patents pacing is handled separately).
+# Defaults to 5 requests/second with a burst of 10.
+# PATENT_CHECKER_SERVER_RPS=5
+# PATENT_CHECKER_SERVER_BURST=10

patent_checker-0.5.0/.github/workflows/ci.yml

@@ -0,0 +1,112 @@
+# CI for patent-checker.
+#
+# "check" runs lint, format check and the unit tests on Linux, "check-macos"
+# and "check-windows" run the unit tests on the other two desktop platforms,
+# and "container" builds the Docker image and drives it through
+# tools/container_smoke.sh (docker compose up, /health, bearer token,
+# operator-notice gate). Unit tests never touch the network; the container
+# smoke test starts the server in degraded mode (no EPO OPS credentials)
+# with a throw-away bearer token that is never printed.
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - "v*"
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.0.1
+        with:
+          enable-cache: true
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync --locked
+
+      - name: Lint, format check and unit tests
+        run: tools/check.sh
+
+      - name: Bootstrap script dry run
+        run: sh install.sh --dry-run
+
+  check-macos:
+    runs-on: macos-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.0.1
+        with:
+          enable-cache: true
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync --locked
+
+      - name: Unit tests
+        run: uv run pytest -q
+
+      - name: Bootstrap script dry run
+        run: sh install.sh --dry-run
+
+  check-windows:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.0.1
+        with:
+          enable-cache: true
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: uv sync --locked
+
+      - name: Unit tests
+        run: uv run pytest -q
+
+      - name: Bootstrap script dry run
+        run: pwsh -NoProfile -File install.ps1 -DryRun
+
+  container:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build the image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          load: true
+          push: false
+          tags: patent-checker:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Smoke-test the image with docker compose
+        env:
+          PATENT_CHECKER_IMAGE: patent-checker:ci
+        run: tools/container_smoke.sh

patent_checker-0.5.0/.github/workflows/release.yml

@@ -0,0 +1,163 @@
+# Release workflow for patent-checker.
+#
+# Runs when a version tag (v*) is pushed: verifies that the tag matches the
+# version declared in pyproject.toml, builds the multi-architecture image and
+# pushes it to GHCR (always) and to Docker Hub (only when the Docker Hub
+# variables and token are configured), then builds the wheel and sdist and
+# publishes them to PyPI through trusted publishing (OIDC), so no API token
+# is stored in the repository.
+#
+# Every push to a version branch (v*) runs the same workflow as a dry run:
+# the image is built for both architectures but not pushed, and the
+# distributions are built but not uploaded. Once the workflow exists on the
+# default branch it can also be started by hand (workflow_dispatch), with
+# `publish` deciding between a dry run and a real publication.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+    branches:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: "Push the image and publish to PyPI (otherwise a dry run)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      publish: ${{ steps.decide.outputs.publish }}
+      images: ${{ steps.decide.outputs.images }}
+      dockerhub: ${{ steps.decide.outputs.dockerhub }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Verify the tag matches the declared version
+        if: github.ref_type == 'tag'
+        run: |
+          declared="$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+          tag="${GITHUB_REF_NAME#v}"
+          if [ "$declared" != "$tag" ]; then
+            echo "tag ${GITHUB_REF_NAME} does not match declared version ${declared}" >&2
+            exit 1
+          fi
+          echo "OK: ${GITHUB_REF_NAME} matches declared version ${declared}"
+
+      - name: Decide what to publish and where
+        id: decide
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          PUBLISH_INPUT: ${{ inputs.publish }}
+          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
+          DOCKERHUB_NAMESPACE: ${{ vars.DOCKERHUB_NAMESPACE }}
+          DOCKERHUB_TOKEN_SET: ${{ secrets.DOCKERHUB_TOKEN != '' }}
+        run: |
+          if [ "$REF_TYPE" = "tag" ] || [ "$PUBLISH_INPUT" = "true" ]; then
+            publish=true
+          else
+            publish=false
+          fi
+          images="ghcr.io/${GITHUB_REPOSITORY}"
+          dockerhub=false
+          if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_NAMESPACE" ] && [ "$DOCKERHUB_TOKEN_SET" = "true" ]; then
+            dockerhub=true
+            images="$(printf '%s\n%s' "$images" "docker.io/${DOCKERHUB_NAMESPACE}/patent-checker")"
+          else
+            echo "Docker Hub is not configured (DOCKERHUB_USERNAME / DOCKERHUB_NAMESPACE / DOCKERHUB_TOKEN); pushing to GHCR only"
+          fi
+          {
+            echo "publish=${publish}"
+            echo "dockerhub=${dockerhub}"
+            echo "images<<EOF"
+            echo "${images}"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+          echo "publish=${publish} dockerhub=${dockerhub}"
+
+  image:
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        if: needs.verify.outputs.publish == 'true'
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        if: needs.verify.outputs.publish == 'true' && needs.verify.outputs.dockerhub == 'true'
+        uses: docker/login-action@v4
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ needs.verify.outputs.images }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+            type=raw,value=dry-run,enable=${{ github.ref_type != 'tag' }}
+          labels: |
+            org.opencontainers.image.title=patent-checker
+            org.opencontainers.image.licenses=Apache-2.0
+
+      - name: Build (and push) the multi-architecture image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ needs.verify.outputs.publish == 'true' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  pypi:
+    needs: [verify, image]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.0.1
+        with:
+          python-version: "3.12"
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Publish to PyPI
+        if: needs.verify.outputs.publish == 'true'
+        run: uv publish --trusted-publishing always

patent_checker-0.5.0/.gitignore

@@ -0,0 +1,231 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+*.lcov
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi/*
+!.pixi/config.toml
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule*
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# プロジェクト固有
+PROJECT.md
+開発資料/
+
+# Patent Checker artifacts and local test fixtures (never tracked)
+.patent-checker/
+tests/fixtures/
+
+# Container secrets mounted by compose.yaml (secrets/README.md stays tracked)
+secrets/*.txt

patent_checker-0.5.0/Dockerfile

@@ -0,0 +1,90 @@
+# syntax=docker/dockerfile:1
+
+# Patent Checker container image.
+#
+# The image is built in two stages because the build needs uv, a writable
+# cache and the whole source tree, while running the server needs none of
+# them: the runtime stage copies only `/app/.venv`, the virtual environment
+# uv resolved from `uv.lock`, so uv itself, the build cache and the sources
+# never reach a published layer. Both stages sit on the same
+# `python:3.12-slim-trixie` base (Debian pinned so that the runtime does not
+# drift under the venv), which is what makes that copy safe -- the venv
+# holds symlinks into `/usr/local`, and the interpreter they point at has to
+# be the identical build.
+#
+# Networking: the server binds 0.0.0.0 because a container's own loopback is
+# unreachable from the host. Binding a non-loopback address makes the server
+# demand PATENT_CHECKER_SERVER_ALLOWED_HOSTS, set here to the loopback names
+# only. That is deliberate: the supported deployment publishes the port on
+# the *host's* loopback (see `127.0.0.1:8642:8642` in compose.yaml), so the
+# only Host headers that can legitimately arrive are `localhost` and
+# `127.0.0.1`, and a DNS-rebinding attempt spelling any other name is
+# refused. Serving a LAN means overriding that variable with the names
+# clients really use and terminating TLS in front -- this transport is
+# plain HTTP.
+
+FROM python:3.12-slim-trixie AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:0.12 /uv /uvx /bin/
+
+# Compile bytecode at install time so the first request does not pay for it;
+# copy out of the cache mount instead of hardlinking, because the cache lives
+# on a different filesystem than the layer; and never let uv download its own
+# interpreter, so the venv is always built against the image's python.
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# Dependencies first, from the lockfile alone. This layer is reused for as
+# long as uv.lock and pyproject.toml are untouched, which is why they are
+# bind-mounted rather than copied: copying them would invalidate the layer on
+# every unrelated file change.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    uv sync --locked --no-install-project --no-dev
+
+COPY . /app
+
+# Then the project itself, installed as a built wheel (`--no-editable`) so
+# the runtime image does not need the source tree to stay in place. The wheel
+# carries the bundled Skill, which is why README.md, LICENSE and skills/ must
+# be part of the build context (see .dockerignore).
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked --no-dev --no-editable
+
+
+FROM python:3.12-slim-trixie
+
+LABEL org.opencontainers.image.source="https://github.com/xhighhongo41/patent-checker" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.description="Patent prior-art exploration MCP server; it explores prior art and does not judge infringement"
+
+# An unprivileged user owns /data, the only path the server ever writes to.
+RUN useradd --uid 1000 --user-group --create-home app \
+    && mkdir -p /data \
+    && chown app:app /data
+
+COPY --from=builder --chown=app:app /app/.venv /app/.venv
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PATENT_CHECKER_DATA_DIR=/data \
+    PATENT_CHECKER_SERVER_HOST=0.0.0.0 \
+    PATENT_CHECKER_SERVER_ALLOWED_HOSTS=localhost,127.0.0.1 \
+    PATENT_CHECKER_LOG_LEVEL=info
+
+USER app
+WORKDIR /data
+VOLUME ["/data"]
+EXPOSE 8642
+
+# curl is deliberately not installed: the venv's python can probe the
+# unauthenticated health endpoint on its own, and every package left out of
+# the runtime image is one less thing to patch.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import sys, urllib.request; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8642/health', timeout=3).status == 200 else 1)"
+
+ENTRYPOINT ["patent-checker"]
+CMD ["serve"]