attackmap 0.6.4__py3-none-any.whl

attackmap/plugins_lock.py

@@ -0,0 +1,114 @@
+"""Official analyzer plugins, pinned to immutable commits (#237).
+
+Generated by scripts/update_plugin_lock.py — do not edit by hand. Only
+these may be auto-installed by `-m` / `suggest --install`, and only at
+the pinned commit.
+"""
+
+OFFICIAL_PLUGINS: list[dict] = [
+    {
+        'repo': 'attackmap-analyzer-python',
+        'package': 'attackmap-analyzer-python',
+        'version': '0.2.0',
+        'git_sha': '9888be5c8f8e9127686e0ed98af9425a34bc7b8c',
+        'entry_points': ['python'],
+    },
+    {
+        'repo': 'attackmap-analyzer-rust',
+        'package': 'attackmap-analyzer-rust',
+        'version': '0.2.0',
+        'git_sha': 'ba6cce7ec1b8055b27c3aa2ddd8884ae410b8ba0',
+        'entry_points': ['rust'],
+    },
+    {
+        'repo': 'attackmap-analyzer-go',
+        'package': 'attackmap-analyzer-go',
+        'version': '0.2.0',
+        'git_sha': '8570338fc67198770b3185633bb0fc35d7db5deb',
+        'entry_points': ['go'],
+    },
+    {
+        'repo': 'attackmap-analyzer-java-spring',
+        'package': 'attackmap-analyzer-java-spring',
+        'version': '0.2.0',
+        'git_sha': '82e23461f6c075d17a709c29c9349a1076d1bafa',
+        'entry_points': ['java_spring'],
+    },
+    {
+        'repo': 'attackmap-analyzer-dotnet',
+        'package': 'attackmap-analyzer-dotnet',
+        'version': '0.2.0',
+        'git_sha': 'fd08a2899f81c7173e257e892fb3914704244f3d',
+        'entry_points': ['dotnet'],
+    },
+    {
+        'repo': 'attackmap-analyzer-terraform',
+        'package': 'attackmap-analyzer-terraform',
+        'version': '0.2.1',
+        'git_sha': '1dfbce9a32c9a2fd6fc1b80f976ea86f69d82cd1',
+        'entry_points': ['terraform'],
+    },
+    {
+        'repo': 'attackmap-analyzer-c',
+        'package': 'attackmap-analyzer-c',
+        'version': '0.2.0',
+        'git_sha': '00f7615a75df47e4ea1a084af562b4cf2e037ef1',
+        'entry_points': ['c'],
+    },
+    {
+        'repo': 'attackmap-analyzer-cpp',
+        'package': 'attackmap-analyzer-cpp',
+        'version': '0.2.0',
+        'git_sha': 'cae9511e8db3ae192af9189a5d15d889e7fd18a8',
+        'entry_points': ['cpp'],
+    },
+    {
+        'repo': 'attackmap-analyzer-swift',
+        'package': 'attackmap-analyzer-swift',
+        'version': '0.2.0',
+        'git_sha': 'eb56ca09c642e580c5cd73391d602f555d429a4b',
+        'entry_points': ['objc', 'swift'],
+    },
+    {
+        'repo': 'attackmap-analyzer-node-service',
+        'package': 'attackmap-analyzer-node-service',
+        'version': '0.3.0',
+        'git_sha': '949269777c020e7a6265fb1436cf1be2fe5004be',
+        'entry_points': ['node_service'],
+    },
+    {
+        'repo': 'attackmap-analyzer-atproto',
+        'package': 'attackmap-analyzer-atproto',
+        'version': '0.2.0',
+        'git_sha': '34b7616d5428549d39848dc4db1af7a71d6e0b56',
+        'entry_points': ['atproto'],
+    },
+    {
+        'repo': 'attackmap-analyzer-php-web',
+        'package': 'attackmap-analyzer-php-web',
+        'version': '0.2.0',
+        'git_sha': '65a5f098c40ae64d3ec3b5d20777eac640fb743b',
+        'entry_points': ['php_web'],
+    },
+    {
+        'repo': 'attackmap-analyzer-php-laminas',
+        'package': 'attackmap-analyzer-php-laminas',
+        'version': '0.2.0',
+        'git_sha': '9046ff6256338850574ee781b69bd2e3f09d2ab2',
+        'entry_points': ['php_laminas'],
+    },
+    {
+        'repo': 'attackmap-analyzer-omeka-s',
+        'package': 'attackmap-analyzer-omeka-s',
+        'version': '0.2.0',
+        'git_sha': '9759c163e30c35256558188cff30dc1cf1331cd5',
+        'entry_points': ['omeka_s'],
+    },
+    {
+        'repo': 'attackmap-analyzer-iac',
+        'package': 'attackmap-analyzer-iac',
+        'version': '0.2.0',
+        'git_sha': 'ef7811cb500b40535740fc104a3d2b29ef627141',
+        'entry_points': ['iac'],
+    },
+]

attackmap/popular_packages.py

@@ -0,0 +1,193 @@
+"""Bundled popular-package names for offline typosquat detection (#247).
+
+Versioned, offline and deterministic: no network lookup ever happens. The
+lists are curated from widely used packages (PyPI download rankings and the
+most-depended-upon npm packages), and also carry near-twins of popular names
+(`boto`/`boto3`, `scipy`/`scapy`) so a legitimate package isn't flagged as a
+squat of its neighbour. Bump ``POPULAR_PACKAGES_VERSION`` when editing.
+
+PyPI names are PEP 503-normalized (lowercase, runs of ``-_.`` → ``-``).
+"""
+
+from __future__ import annotations
+
+POPULAR_PACKAGES_VERSION = "2026.10.1"
+
+PYPI: frozenset[str] = frozenset((
+    "accelerate", "adal", "aiobotocore", "aiohttp", "aiosignal", "alabaster",
+    "alembic", "altair", "amqp", "angr", "annotated-types", "ansible", "ansible-core",
+    "anthropic", "anyio", "apscheduler", "arcade", "argon2-cffi", "ariadne", "arrow",
+    "asgiref", "astroid", "asttokens", "async-timeout", "asyncpg", "attrs", "authlib",
+    "automat", "autopep8", "awscli", "azure-common", "azure-core", "azure-identity",
+    "azure-storage-blob", "babel", "backoff", "bandit", "bcrypt", "beautifulsoup4",
+    "bidict", "billiard", "binaryornot", "black", "bleach", "blinker", "bokeh", "boto",
+    "boto3", "botocore", "build", "cachecontrol", "cachetools", "capstone",
+    "cassandra-driver", "catboost", "cattrs", "celery", "certifi", "cffi", "cfgv",
+    "channels", "chardet", "charset-normalizer", "click", "cloudpickle", "cmake",
+    "colorama", "colorlog", "comm", "comtypes", "confluent-kafka", "constantly",
+    "contourpy", "cookiecutter", "coverage", "croniter", "cryptography", "cssselect",
+    "cx-freeze", "cycler", "cython", "cytoolz", "daphne", "dash", "dask",
+    "dataclasses-json", "datadog", "datasets", "ddtrace", "debugpy", "decorator",
+    "deepdiff", "defusedxml", "dill", "diskcache", "distlib", "distributed", "django",
+    "django-cors-headers", "djangorestframework", "dnspython", "docker", "docutils",
+    "duckdb", "dynaconf", "ecdsa", "elasticsearch", "email-validator", "emoji",
+    "environs", "et-xmlfile", "eventlet", "exceptiongroup", "execnet", "executing",
+    "fabric", "factory-boy", "faker", "fastapi", "feedparser", "filelock", "findspark",
+    "fiona", "flake8", "flask", "flask-cors", "flask-jwt-extended", "flask-login",
+    "flask-migrate", "flask-restful", "flask-sqlalchemy", "flask-wtf", "flit-core",
+    "fonttools", "freezegun", "frida", "frida-tools", "frozenlist", "fsspec", "ftfy",
+    "gensim", "geopandas", "gevent", "gnupg", "google-api-core",
+    "google-api-python-client", "google-auth", "google-auth-httplib2",
+    "google-auth-oauthlib", "google-cloud-core", "google-cloud-storage",
+    "google-crc32c", "google-resumable-media", "googleapis-common-protos", "gradio",
+    "graphene", "graphql-core", "greenlet", "grpcio", "grpcio-status", "gunicorn",
+    "h11", "h5py", "hatchling", "html5lib", "httpcore", "httplib2", "httptools",
+    "httpx", "huggingface-hub", "humanize", "hyperlink", "hypothesis", "identify",
+    "idna", "imageio", "imagesize", "impacket", "importlib-metadata", "incremental",
+    "iniconfig", "invoke", "ipaddress", "ipykernel", "ipython", "ipywidgets",
+    "isodate", "isort", "itemadapter", "itsdangerous", "jaraco-classes", "jedi",
+    "jeepney", "jinja2", "jinja2-time", "jmespath", "joblib", "jsonpatch",
+    "jsonpath-ng", "jsonpointer", "jsonschema", "jsonschema-specifications", "jupyter",
+    "jupyter-client", "jupyter-core", "jupyterlab", "jupyterlab-server", "jwcrypto",
+    "kafka-python", "keras", "keyring", "keystone-engine", "kivy", "kiwisolver",
+    "kombu", "kubernetes", "langchain", "langchain-community", "langchain-core",
+    "langdetect", "lief", "lightgbm", "llvmlite", "locket", "loguru", "lxml", "mako",
+    "markdown", "markdown-it-py", "markupsafe", "marshmallow", "matplotlib",
+    "matplotlib-inline", "mccabe", "mdurl", "meson", "mistune", "mkdocs",
+    "mkdocs-material", "mock", "more-itertools", "moto", "motor", "mpmath", "msal",
+    "msal-extensions", "msgpack", "msrest", "msrestazure", "multidict", "mypy",
+    "mypy-extensions", "mysqlclient", "nbclient", "nbconvert", "nbformat",
+    "nest-asyncio", "netaddr", "netcdf4", "netifaces", "networkx", "ninja", "nltk",
+    "nmap", "nodeenv", "nose", "nose2", "notebook", "nox", "numba", "numpy",
+    "oauth2client", "oauthlib", "openai", "opencv-python", "opencv-python-headless",
+    "openpyxl", "opentelemetry-api", "opentelemetry-sdk", "orjson", "packaging",
+    "pandas", "pandocfilters", "paramiko", "parsel", "parso", "partd", "passlib",
+    "patsy", "pdm", "peewee", "pefile", "pendulum", "pexpect", "phonenumbers", "pika",
+    "pillow", "pip", "pkginfo", "platformdirs", "playwright", "plotly", "pluggy",
+    "poetry", "poetry-core", "polars", "pony", "pre-commit", "prettytable",
+    "prometheus-client", "prompt-toolkit", "protobuf", "psutil", "psycopg", "psycopg2",
+    "psycopg2-binary", "ptyprocess", "pure-eval", "pwntools", "py2exe", "py4j",
+    "pyarrow", "pyasn1", "pyasn1-modules", "pybind11", "pycodestyle", "pycountry",
+    "pycparser", "pycryptodome", "pycryptodomex", "pydantic", "pydantic-core",
+    "pydantic-settings", "pyelftools", "pyflakes", "pygame", "pyglet", "pygments",
+    "pyhamcrest", "pyinstaller", "pyjwt", "pylint", "pymdown-extensions", "pymongo",
+    "pymysql", "pynacl", "pyobjc", "pyopengl", "pyopenssl", "pyotp", "pyparsing",
+    "pyppeteer", "pyproj", "pyproject-hooks", "pyqt5", "pyqt6", "pyquery",
+    "pyrsistent", "pyside6", "pysnmp", "pyspark", "pytest", "pytest-asyncio",
+    "pytest-cov", "pytest-mock", "pytest-timeout", "pytest-xdist", "python-dateutil",
+    "python-dotenv", "python-engineio", "python-gnupg", "python-jose",
+    "python-multipart", "python-nmap", "python-slugify", "python-socketio", "pytz",
+    "pyvmomi", "pywin32", "pywin32-ctypes", "pyyaml", "pyzmq", "qrcode", "r2pipe",
+    "readme-renderer", "redis", "redis-py-cluster", "referencing", "regex", "requests",
+    "requests-mock", "requests-oauthlib", "responses", "retrying", "rich", "ropgadget",
+    "rpds-py", "rsa", "ruff", "s3fs", "s3transfer", "safetensors", "salt", "scapy",
+    "schedule", "scikit-build", "scikit-image", "scikit-learn", "scipy", "scrapy",
+    "seaborn", "secretstorage", "selenium", "sentencepiece", "sentry-sdk",
+    "service-identity", "setuptools", "setuptools-scm", "shapely", "shellingham",
+    "shodan", "simplejson", "six", "sniffio", "snowballstemmer",
+    "snowflake-connector-python", "sortedcontainers", "soupsieve", "spacy", "sphinx",
+    "sphinx-rtd-theme", "sqlalchemy", "sqlalchemy-utils", "sqlparse", "stack-data",
+    "starlette", "statsmodels", "strawberry-graphql", "streamlit", "structlog",
+    "sympy", "tables", "tabulate", "tblib", "tenacity", "tensorboard", "tensorflow",
+    "termcolor", "text-unidecode", "threadpoolctl", "tifffile", "tiktoken", "tinycss2",
+    "tokenizers", "toml", "tomli", "tomlkit", "toolz", "torch", "torchaudio",
+    "torchvision", "tornado", "tortoise-orm", "tox", "tqdm", "traitlets",
+    "transformers", "twine", "twisted", "typer", "typing-extensions", "tzdata",
+    "ujson", "unicorn", "unidecode", "uritemplate", "urllib3", "uvicorn", "uvloop",
+    "vine", "virtualenv", "w3lib", "watchdog", "watchfiles", "wcwidth", "webencodings",
+    "websocket-client", "websockets", "werkzeug", "wheel", "wrapt", "wtforms",
+    "wxpython", "xarray", "xgboost", "xmltodict", "yapf", "yara-python", "yarl",
+    "z3-solver", "zict", "zipp", "zope-interface",
+))
+
+NPM: frozenset[str] = frozenset((
+    "@apollo/client", "@aws-sdk/client-s3", "@babel/core", "@babel/generator",
+    "@babel/parser", "@babel/preset-env", "@babel/preset-react",
+    "@babel/preset-typescript", "@babel/runtime", "@babel/traverse", "@babel/types",
+    "@emotion/react", "@emotion/styled", "@material-ui/core", "@mui/material",
+    "@nestjs/common", "@nestjs/core", "@prisma/client", "@reduxjs/toolkit",
+    "@tanstack/react-query", "@types/express", "@types/jest", "@types/lodash",
+    "@types/node", "@types/react", "@types/react-dom",
+    "@typescript-eslint/eslint-plugin", "@typescript-eslint/parser", "accepts",
+    "adm-zip", "ajv", "ajv-keywords", "amqplib", "angular", "ansi-regex",
+    "ansi-styles", "antd", "anymatch", "apollo-server", "archiver", "array-flatten",
+    "async", "asynckit", "autoprefixer", "aws-sdk", "axios", "babel-core",
+    "babel-loader", "balanced-match", "base64-js", "bcrypt", "bcryptjs",
+    "better-sqlite3", "big.js", "binary-extensions", "bindings", "bl", "bluebird",
+    "body-parser", "bootstrap", "boxen", "brace-expansion", "braces", "browserify",
+    "browserslist", "buffer", "buffer-from", "bull", "bullmq", "bunyan", "busboy",
+    "bytes", "call-bind", "callsites", "camelcase", "caniuse-lite", "canvas", "chai",
+    "chalk", "chart.js", "cheerio", "chokidar", "chownr", "class-transformer",
+    "class-validator", "classnames", "clean-css", "cli-spinners", "clipboardy",
+    "cliui", "clone", "color-convert", "color-name", "colors", "combined-stream",
+    "commander", "compression", "concat-map", "concurrently", "configstore",
+    "content-disposition", "content-type", "cookie", "cookie-parser",
+    "copy-webpack-plugin", "core-js", "core-util-is", "cors", "cosmiconfig", "cpy-cli",
+    "cross-env", "cross-fetch", "cross-spawn", "crypto-js", "css-loader", "cssnano",
+    "csv-parse", "d3", "date-fns", "dayjs", "debug", "decamelize", "deep-equal",
+    "deep-extend", "deepmerge", "define-properties", "delayed-stream", "depd",
+    "destroy", "dotenv", "duplexify", "ee-first", "ejs", "electron-to-chromium",
+    "emojis-list", "encodeurl", "end-of-stream", "engine.io", "enhanced-resolve",
+    "enquirer", "es-abstract", "esbuild", "escape-html", "escape-string-regexp",
+    "eslint", "eslint-config-airbnb", "eslint-config-prettier", "eslint-plugin-import",
+    "eslint-plugin-jsx-a11y", "eslint-plugin-prettier", "eslint-plugin-react",
+    "eslint-plugin-react-hooks", "etag", "eventemitter3", "events", "exceljs", "execa",
+    "express", "express-session", "fast-deep-equal", "fast-json-stable-stringify",
+    "fast-xml-parser", "fastify", "figures", "file-loader", "fill-range",
+    "finalhandler", "find-up", "firebase", "firebase-admin",
+    "fork-ts-checker-webpack-plugin", "form-data", "formidable", "formik", "forwarded",
+    "fresh", "fs-extra", "fs-minipass", "fsevents", "function-bind", "get-caller-file",
+    "get-intrinsic", "get-stream", "glob", "glob-parent", "googleapis", "got",
+    "graceful-fs", "graphql", "graphql-tag", "grunt", "gulp", "handlebars", "hapi",
+    "has", "has-flag", "hasown", "helmet", "highlight.js", "history",
+    "html-webpack-plugin", "http-errors", "http-proxy", "http-proxy-middleware",
+    "human-signals", "husky", "iconv-lite", "ieee754", "immer", "immutable",
+    "import-fresh", "inflight", "inherits", "ini", "inquirer", "ioredis", "ipaddr.js",
+    "is-core-module", "is-docker", "is-extglob", "is-glob", "is-number", "is-stream",
+    "is-wsl", "isarray", "isexe", "isomorphic-fetch", "jasmine", "jest", "jimp", "joi",
+    "jquery", "js-tokens", "js-yaml", "jsdom", "json-schema-traverse",
+    "json-stable-stringify", "json5", "jsonfile", "jsonwebtoken", "jszip", "kafkajs",
+    "karma", "kleur", "knex", "koa", "koa-router", "latest-version", "leaflet", "less",
+    "lint-staged", "listr2", "loader-utils", "locate-path", "lodash",
+    "lodash.debounce", "lodash.get", "lodash.isequal", "lodash.merge", "log-symbols",
+    "log4js", "loose-envify", "lru-cache", "luxon", "mapbox-gl", "markdown-it",
+    "marked", "media-typer", "memory-fs", "meow", "merge-descriptors", "merge-stream",
+    "methods", "micromatch", "mime", "mime-db", "mime-types", "mimic-fn",
+    "mini-css-extract-plugin", "minimatch", "minimist", "minipass", "mitt", "mkdirp",
+    "mobx", "mocha", "moment", "mongodb", "mongoose", "morgan", "ms", "multer",
+    "mustache", "mysql", "mysql2", "nan", "nanoid", "needle", "negotiator",
+    "neo-async", "next", "node-addon-api", "node-fetch", "node-gyp", "node-releases",
+    "nodemailer", "nodemon", "normalize-path", "npm-run-all", "npm-run-path",
+    "numeral", "nunjucks", "nuxt", "object-assign", "object-keys", "on-finished",
+    "once", "onetime", "open", "opn", "ora", "p-limit", "p-locate", "p-try",
+    "package-json", "papaparse", "parcel", "parent-module", "passport", "passport-jwt",
+    "passport-local", "path-exists", "path-is-absolute", "path-key", "path-parse",
+    "path-to-regexp", "pdfkit", "pg", "pg-promise", "picocolors", "picomatch", "pino",
+    "pkg-dir", "playwright", "postcss", "postcss-loader", "prebuild-install",
+    "prettier", "prisma", "process-nextick-args", "prompts", "prop-types",
+    "proxy-addr", "psl", "pug", "pump", "punycode", "puppeteer", "qs", "query-string",
+    "querystring", "range-parser", "raw-body", "rc", "react", "react-bootstrap",
+    "react-dom", "react-hook-form", "react-query", "react-redux", "react-router",
+    "react-router-dom", "readable-stream", "readdirp", "recoil", "redis", "redux",
+    "redux-saga", "redux-thunk", "reflect-metadata", "regenerator-runtime",
+    "registry-url", "request", "require-directory", "resolve", "resolve-from",
+    "restify", "rimraf", "rollup", "rxjs", "rxjs-compat", "safe-buffer", "sass",
+    "sass-loader", "schema-utils", "selenium-webdriver", "semver", "send", "sequelize",
+    "serve-favicon", "serve-static", "setprototypeof", "sharp", "shebang-command",
+    "shebang-regex", "shelljs", "showdown", "signal-exit", "sinon", "socket.io",
+    "socket.io-client", "source-map", "source-map-support", "sqlite3", "statuses",
+    "stream-shift", "string-width", "string_decoder", "strip-ansi",
+    "strip-final-newline", "strip-json-comments", "stripe", "style-loader",
+    "styled-components", "stylus", "superagent", "supports-color", "svelte", "swr",
+    "tailwindcss", "tapable", "tar", "tar-stream", "terser", "terser-webpack-plugin",
+    "three", "through2", "to-regex-range", "toidentifier", "tough-cookie", "ts-loader",
+    "ts-node", "tslib", "twilio", "type-is", "typeorm", "typescript", "uglify-js",
+    "underscore", "universalify", "unpipe", "unzipper", "update-browserslist-db",
+    "update-notifier", "uri-js", "url-loader", "url-parse", "util-deprecate",
+    "utils-merge", "uuid", "validator", "vary", "vite", "vue", "watchpack", "webpack",
+    "webpack-cli", "webpack-dev-server", "whatwg-fetch", "which", "winston",
+    "wrap-ansi", "wrappy", "ws", "xdg-basedir", "xlsx", "xml2js", "y18n", "yallist",
+    "yaml", "yargs", "yargs-parser", "yup", "zod", "zone.js", "zustand",
+))
+
+BY_ECOSYSTEM: dict[str, frozenset[str]] = {"pypi": PYPI, "npm": NPM}

attackmap/progress.py

@@ -0,0 +1,258 @@
+"""Live scan progress with ETA (#36), for terminals and for front-ends.
+
+A repo scan can run for many minutes on a large tree, and a silent terminal
+reads as "hung." This renders a single, self-updating status line to stderr:
+a bar + percentage + count + ETA during the per-file pass, and an animated
+spinner with elapsed time during the indeterminate tail analyzers (taint,
+SBOM, authorization, anomalies) — the phase where a big monorepo spends most
+of its time.
+
+Zero third-party deps. TTY-aware: when stderr isn't a terminal (CI, piped to
+a file) it stays silent so logs aren't polluted with carriage returns. The
+scanner drives it through the small hook surface (`begin`/`advance`/`stage`/
+`done`); when no progress object is passed, the scan runs exactly as before.
+
+Two renderers implement that hook surface: :class:`ScanProgress` (the TTY
+status line above) and :class:`JsonScanProgress`, which always emits NDJSON
+events for the macOS GUI and other non-TTY front-ends.
+:func:`create_progress` picks one from ``--progress-format``.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import threading
+import time
+from typing import TextIO
+
+# NDJSON progress protocol version (consumed by the macOS GUI and other
+# non-TTY front-ends). Bump only on a breaking change to the event shape.
+PROGRESS_PROTOCOL_VERSION = 1
+
+_SPINNER = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
+_BAR_WIDTH = 24
+_MIN_REDRAW_INTERVAL = 0.08  # seconds — cap redraws so we don't thrash the TTY
+
+
+def _fmt_duration(seconds: float) -> str:
+    seconds = int(max(0, seconds))
+    if seconds >= 3600:
+        return f"{seconds // 3600}h{(seconds % 3600) // 60:02d}m"
+    return f"{seconds // 60:02d}:{seconds % 60:02d}"
+
+
+class ScanProgress:
+    """Render scan progress to a TTY. All methods are no-ops when disabled."""
+
+    def __init__(self, *, enabled: bool = True, stream: TextIO | None = None) -> None:
+        stream = stream if stream is not None else sys.stderr
+        self._stream = stream
+        self._enabled = enabled and hasattr(stream, "isatty") and stream.isatty()
+        self._total = 0
+        self._done = 0
+        self._start = 0.0
+        self._last_draw = 0.0
+        self._last_len = 0
+        self._label = ""
+        # Spinner thread state for indeterminate stages.
+        self._spin_stop: threading.Event | None = None
+        self._spin_thread: threading.Thread | None = None
+        self._lock = threading.Lock()
+
+    # --- per-file phase ---------------------------------------------------
+
+    def begin(self, total: int, label: str = "Scanning files") -> None:
+        if not self._enabled:
+            return
+        self._stop_spinner()
+        self._total = max(0, total)
+        self._done = 0
+        self._label = label
+        self._start = time.monotonic()
+        self._draw(force=True)
+
+    def advance(self, current: str = "") -> None:
+        if not self._enabled:
+            return
+        self._done += 1
+        self._draw(current=current)
+
+    # --- indeterminate tail phases ---------------------------------------
+
+    def stage(self, label: str) -> None:
+        """Switch to an indeterminate phase with an animated spinner."""
+        if not self._enabled:
+            return
+        self._stop_spinner()
+        self._label = label
+        stop = threading.Event()
+        self._spin_stop = stop
+        started = time.monotonic()
+
+        def _spin() -> None:
+            i = 0
+            while not stop.is_set():
+                frame = _SPINNER[i % len(_SPINNER)]
+                with self._lock:
+                    self._write(f"{frame} {label}… ({_fmt_duration(time.monotonic() - started)})")
+                i += 1
+                stop.wait(0.12)
+
+        thread = threading.Thread(target=_spin, daemon=True)
+        self._spin_thread = thread
+        thread.start()
+
+    def done(self, summary: str = "") -> None:
+        if not self._enabled:
+            return
+        self._stop_spinner()
+        with self._lock:
+            self._clear_line()
+            if summary:
+                self._stream.write(summary + "\n")
+            self._stream.flush()
+
+    # --- internals --------------------------------------------------------
+
+    def _stop_spinner(self) -> None:
+        if self._spin_stop is not None:
+            self._spin_stop.set()
+        if self._spin_thread is not None:
+            self._spin_thread.join(timeout=0.5)
+        self._spin_stop = None
+        self._spin_thread = None
+
+    def _draw(self, *, current: str = "", force: bool = False) -> None:
+        now = time.monotonic()
+        if not force and (now - self._last_draw) < _MIN_REDRAW_INTERVAL and self._done < self._total:
+            return
+        self._last_draw = now
+        total = self._total or 1
+        frac = min(1.0, self._done / total)
+        filled = int(_BAR_WIDTH * frac)
+        bar = "█" * filled + "░" * (_BAR_WIDTH - filled)
+        elapsed = now - self._start
+        eta = (elapsed / frac - elapsed) if frac > 0 else 0.0
+        tail = f"  {_truncate(current, 32)}" if current else ""
+        line = (
+            f"{self._label}  [{bar}] {int(frac * 100):3d}%  "
+            f"{self._done}/{self._total}  ETA {_fmt_duration(eta)}{tail}"
+        )
+        with self._lock:
+            self._write(line)
+
+    def _write(self, text: str) -> None:
+        # Pad to erase any leftover from a previous longer line.
+        pad = max(0, self._last_len - len(text))
+        self._stream.write("\r" + text + " " * pad)
+        self._stream.flush()
+        self._last_len = len(text)
+
+    def _clear_line(self) -> None:
+        if self._last_len:
+            self._stream.write("\r" + " " * self._last_len + "\r")
+            self._last_len = 0
+
+
+def _truncate(text: str, width: int) -> str:
+    text = text.replace("\\", "/")
+    if len(text) <= width:
+        return text
+    return "…" + text[-(width - 1):]
+
+
+class JsonScanProgress:
+    """Emit scan progress as newline-delimited JSON (one object per line).
+
+    Same hook surface as ``ScanProgress`` (``begin``/``advance``/``stage``/
+    ``done``) so the scanner drives either interchangeably. Unlike the TTY
+    renderer this never gates on ``isatty`` — its whole purpose is to feed a
+    non-terminal consumer (the macOS GUI) reading the child process's stderr.
+
+    Event shapes (all carry ``"v": PROGRESS_PROTOCOL_VERSION``)::
+
+        {"v":1,"event":"begin","total":1240,"label":"Scanning files"}
+        {"v":1,"event":"advance","done":37,"total":1240,"current":"src/app.ts"}
+        {"v":1,"event":"stage","label":"Taint analysis"}
+        {"v":1,"event":"done","summary":"…","done":1240,"total":1240,"elapsed_s":92.4}
+
+    ``advance`` events are throttled to at most one per ``min_interval`` seconds
+    to keep the stream sane on large trees; ``done`` (per-file count) stays
+    accurate because every advance still increments the internal counter and the
+    latest count rides on each emitted event.
+    """
+
+    def __init__(self, *, stream: TextIO | None = None, min_interval: float = 0.1) -> None:
+        self._stream = stream if stream is not None else sys.stderr
+        self._min_interval = max(0.0, min_interval)
+        self._total = 0
+        self._done = 0
+        self._start = 0.0
+        self._last_emit = 0.0
+
+    def begin(self, total: int, label: str = "Scanning files") -> None:
+        self._total = max(0, total)
+        self._done = 0
+        self._start = time.monotonic()
+        self._last_emit = self._start  # anchor throttle window to scan start
+        self._emit("begin", total=self._total, label=label)
+
+    def advance(self, current: str = "") -> None:
+        self._done += 1
+        now = time.monotonic()
+        # Always emit the final file; throttle the rest.
+        if self._done < self._total and (now - self._last_emit) < self._min_interval:
+            return
+        self._last_emit = now
+        self._emit("advance", done=self._done, total=self._total, current=current)
+
+    def stage(self, label: str) -> None:
+        self._emit("stage", label=label)
+
+    def done(self, summary: str = "") -> None:
+        elapsed = round(time.monotonic() - self._start, 3) if self._start else 0.0
+        self._emit(
+            "done",
+            summary=summary,
+            done=self._done,
+            total=self._total,
+            elapsed_s=elapsed,
+        )
+
+    def _emit(self, event: str, **fields: object) -> None:
+        payload = {"v": PROGRESS_PROTOCOL_VERSION, "event": event, **fields}
+        try:
+            self._stream.write(json.dumps(payload, ensure_ascii=False) + "\n")
+            self._stream.flush()
+        except (ValueError, OSError):
+            # Never let a broken/closed pipe take down a scan.
+            pass
+
+
+def create_progress(
+    fmt: str = "auto",
+    *,
+    no_progress: bool = False,
+    stream: TextIO | None = None,
+):
+    """Build the right progress sink for ``--progress-format``.
+
+    - ``none`` (or ``no_progress=True``) → a disabled ``ScanProgress`` no-op.
+    - ``json`` → :class:`JsonScanProgress` (NDJSON, always emits).
+    - ``auto`` / ``tty`` → :class:`ScanProgress` (TTY bar, self-silences when
+      stderr isn't a terminal).
+    """
+    if no_progress or fmt == "none":
+        return ScanProgress(enabled=False, stream=stream)
+    if fmt == "json":
+        return JsonScanProgress(stream=stream)
+    return ScanProgress(enabled=True, stream=stream)
+
+
+__all__ = [
+    "ScanProgress",
+    "JsonScanProgress",
+    "create_progress",
+    "PROGRESS_PROTOCOL_VERSION",
+]

attackmap/recon_models.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+# Phase-1 shared recon/result model exports.
+# Keep ScanResult and recon signal models as the single source of truth via models.py.
+from .models import (
+    AuthHint,
+    DatabaseHint,
+    EdgeHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    ProtocolHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+__all__ = [
+    "Route",
+    "ExternalCall",
+    "DatabaseHint",
+    "AuthHint",
+    "ServiceHint",
+    "EdgeHint",
+    "EntrypointHint",
+    "ProtocolHint",
+    "FrameworkHint",
+    "SecretHint",
+    "ScanResult",
+]