ipmg 2.1.0__tar.gz → 2.2.0__tar.gz

{ipmg-2.1.0/src/ipmg.egg-info → ipmg-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ipmg
-Version: 2.1.0
+Version: 2.2.0
 Summary: IP Management & Ping Monitoring CLI Tool
 Author: Sameer Alam
 Maintainer-email: Sameer Alam <sameeralam3127@gmail.com>
@@ -436,6 +436,12 @@ ipmg web               # starts http://127.0.0.1:8080 and opens your browser
 
 `ipmg --web` does the same thing, so whichever one you reach for first works.
 
+Each start creates a new access token. The browser opens with it already in
+the link, and IPMG Web prints that link (`http://127.0.0.1:8080/#token=…`)
+in the terminal. If you open IPMG Web in another browser, or after a
+restart, use the link from the terminal. To keep the same token across
+restarts, for example behind a reverse proxy, set `IPMG_WEB_TOKEN`.
+
 It runs fully offline — every stylesheet and script is bundled with the
 package, nothing is loaded from a CDN. It gives you:
 
@@ -465,12 +471,13 @@ it from your workstation with an SSH tunnel:
 
 ```bash
 ssh -L 8080:127.0.0.1:8080 user@server
-# then open http://127.0.0.1:8080 locally
+# then open the link the server printed (http://127.0.0.1:8080/#token=…) locally
 ```
 
-Alternatively, bind to all interfaces with `--host 0.0.0.0` — this exposes an
-unauthenticated API on the network, so only do this on a trusted network or
-behind a reverse proxy with authentication (see [Security](#security)).
+Alternatively, bind to all interfaces with `--host 0.0.0.0`. Every request
+still needs the access token. The traffic, token included, is plain HTTP,
+so on anything but a trusted network put a reverse proxy with TLS in front
+of it (see [Security](#security)).
 
 ---
 
@@ -535,6 +542,21 @@ default). A finished scan overwrites those files with the complete report, so
 the file names and contents are the same as they always were. Use
 `--no-incremental` to go back to writing only at the end.
 
+**Pick up where an interrupted scan stopped.** `--resume` reads the hosts the
+partial report already holds, scans only the rest, and finishes that same
+report — same file names, same batch timestamp:
+
+```bash
+ipmg --input 10.0.0.0/16 --formats jsonl xlsx     # Ctrl+C partway through
+ipmg --input 10.0.0.0/16 --formats jsonl xlsx --resume
+ipmg --input 10.0.0.0/16 --resume results_20260917_120000.csv
+```
+
+Without a path, `--resume` takes the newest report named after `--output`,
+preferring `jsonl` or `csv` (current to the last host) over `json` or `xlsx`
+(current to the last autosave). Hosts dropped from the target list since are
+left out of the finished report.
+
 **Open ports.** `Open Ports` is only populated when `--scan-ports` is set: for
 each host that answers, IPMG probes a list of common TCP ports (SSH, HTTP,
 HTTPS, RDP, SMB, FTP, SMTP, DNS, MSSQL, MySQL, PostgreSQL by default)
@@ -565,6 +587,7 @@ them — so piping IPMG into a file or a log gives you clean text.
 | `--formats` | `xlsx` | One or more of `xlsx`, `csv`, `json`, `jsonl`, `md` |
 | `--no-incremental` | off | Only write the report once the scan has finished |
 | `--autosave` | `30` | How often a running scan re-saves `xlsx`, `json`, and `md` |
+| `--resume` | off | Finish an interrupted scan from its partial report (newest one, or the path given) |
 
 **Speed and accuracy**
 
@@ -612,15 +635,18 @@ itself is hardened accordingly:
   validated as an IP address first
 - IPMG Web binds to `127.0.0.1` by default and serves everything
   locally — no CDN assets, no outbound requests
-- WebSocket connections are origin-checked, so a web page you happen to
-  visit cannot connect to your local IPMG Web and read your scan results
+- Every API request and WebSocket needs the access token created when
+  IPMG Web starts, so other users on the machine and web pages you happen
+  to visit cannot start scans or read your results
+- WebSocket connections are also origin-checked, and a client that stops
+  reading live updates is disconnected rather than buffered without limit
 - Uploads are capped at 5 MB and one scan expands to at most 65,536 hosts,
   so a bad input file cannot exhaust memory
 - All database access uses parameterized SQL
 
-If you bind to a non-local address with `--host`, anyone who can reach that
-interface can start scans and read results — put a reverse proxy with
-authentication in front of it.
+If you bind to a non-local address with `--host`, the token still guards the
+API. It travels over plain HTTP, though, so use an SSH tunnel or a reverse
+proxy with TLS on any network you don't trust.
 
 Found a vulnerability? See [SECURITY.md](SECURITY.md) for how to report it.
 

{ipmg-2.1.0 → ipmg-2.2.0}/README.md

@@ -389,6 +389,12 @@ ipmg web               # starts http://127.0.0.1:8080 and opens your browser
 
 `ipmg --web` does the same thing, so whichever one you reach for first works.
 
+Each start creates a new access token. The browser opens with it already in
+the link, and IPMG Web prints that link (`http://127.0.0.1:8080/#token=…`)
+in the terminal. If you open IPMG Web in another browser, or after a
+restart, use the link from the terminal. To keep the same token across
+restarts, for example behind a reverse proxy, set `IPMG_WEB_TOKEN`.
+
 It runs fully offline — every stylesheet and script is bundled with the
 package, nothing is loaded from a CDN. It gives you:
 
@@ -418,12 +424,13 @@ it from your workstation with an SSH tunnel:
 
 ```bash
 ssh -L 8080:127.0.0.1:8080 user@server
-# then open http://127.0.0.1:8080 locally
+# then open the link the server printed (http://127.0.0.1:8080/#token=…) locally
 ```
 
-Alternatively, bind to all interfaces with `--host 0.0.0.0` — this exposes an
-unauthenticated API on the network, so only do this on a trusted network or
-behind a reverse proxy with authentication (see [Security](#security)).
+Alternatively, bind to all interfaces with `--host 0.0.0.0`. Every request
+still needs the access token. The traffic, token included, is plain HTTP,
+so on anything but a trusted network put a reverse proxy with TLS in front
+of it (see [Security](#security)).
 
 ---
 
@@ -488,6 +495,21 @@ default). A finished scan overwrites those files with the complete report, so
 the file names and contents are the same as they always were. Use
 `--no-incremental` to go back to writing only at the end.
 
+**Pick up where an interrupted scan stopped.** `--resume` reads the hosts the
+partial report already holds, scans only the rest, and finishes that same
+report — same file names, same batch timestamp:
+
+```bash
+ipmg --input 10.0.0.0/16 --formats jsonl xlsx     # Ctrl+C partway through
+ipmg --input 10.0.0.0/16 --formats jsonl xlsx --resume
+ipmg --input 10.0.0.0/16 --resume results_20260917_120000.csv
+```
+
+Without a path, `--resume` takes the newest report named after `--output`,
+preferring `jsonl` or `csv` (current to the last host) over `json` or `xlsx`
+(current to the last autosave). Hosts dropped from the target list since are
+left out of the finished report.
+
 **Open ports.** `Open Ports` is only populated when `--scan-ports` is set: for
 each host that answers, IPMG probes a list of common TCP ports (SSH, HTTP,
 HTTPS, RDP, SMB, FTP, SMTP, DNS, MSSQL, MySQL, PostgreSQL by default)
@@ -518,6 +540,7 @@ them — so piping IPMG into a file or a log gives you clean text.
 | `--formats` | `xlsx` | One or more of `xlsx`, `csv`, `json`, `jsonl`, `md` |
 | `--no-incremental` | off | Only write the report once the scan has finished |
 | `--autosave` | `30` | How often a running scan re-saves `xlsx`, `json`, and `md` |
+| `--resume` | off | Finish an interrupted scan from its partial report (newest one, or the path given) |
 
 **Speed and accuracy**
 
@@ -565,15 +588,18 @@ itself is hardened accordingly:
   validated as an IP address first
 - IPMG Web binds to `127.0.0.1` by default and serves everything
   locally — no CDN assets, no outbound requests
-- WebSocket connections are origin-checked, so a web page you happen to
-  visit cannot connect to your local IPMG Web and read your scan results
+- Every API request and WebSocket needs the access token created when
+  IPMG Web starts, so other users on the machine and web pages you happen
+  to visit cannot start scans or read your results
+- WebSocket connections are also origin-checked, and a client that stops
+  reading live updates is disconnected rather than buffered without limit
 - Uploads are capped at 5 MB and one scan expands to at most 65,536 hosts,
   so a bad input file cannot exhaust memory
 - All database access uses parameterized SQL
 
-If you bind to a non-local address with `--host`, anyone who can reach that
-interface can start scans and read results — put a reverse proxy with
-authentication in front of it.
+If you bind to a non-local address with `--host`, the token still guards the
+API. It travels over plain HTTP, though, so use an SSH tunnel or a reverse
+proxy with TLS on any network you don't trust.
 
 Found a vulnerability? See [SECURITY.md](SECURITY.md) for how to report it.
 

{ipmg-2.1.0 → ipmg-2.2.0}/pyproject.toml

@@ -13,7 +13,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ipmg"
-version = "2.1.0"  # Managed automatically by semantic-release
+version = "2.2.0"  # Managed automatically by semantic-release
 description = "IP Management & Ping Monitoring CLI Tool"
 readme = "README.md"
 requires-python = ">=3.9"

{ipmg-2.1.0 → ipmg-2.2.0}/src/ipmg/__init__.py

@@ -2,4 +2,4 @@
 ipmg - IP Management & Ping Monitoring Tool
 """
 
-__version__ = "2.1.0"
+__version__ = "2.2.0"

{ipmg-2.1.0 → ipmg-2.2.0}/src/ipmg/cli/parser.py

@@ -219,6 +219,18 @@ def build_parser() -> argparse.ArgumentParser:
             "csv and jsonl are written per host regardless."
         ),
     )
+    reports.add_argument(
+        "--resume",
+        nargs="?",
+        const="",
+        default=None,
+        metavar="REPORT",
+        help=(
+            "Finish an interrupted scan: skip the hosts its report already holds and "
+            "complete that report. REPORT is its jsonl, csv, json, or xlsx file "
+            "(default: the newest report named after --output)."
+        ),
+    )
 
     live = parser.add_argument_group("live output")
     live.add_argument(

{ipmg-2.1.0 → ipmg-2.2.0}/src/ipmg/core/engine.py

@@ -11,6 +11,11 @@ from ipmg.core.portscan import DEFAULT_PORTS, scan_ports
 from ipmg.exceptions import PingError
 from ipmg.utils.helpers import HostnameCache, clamp_int
 
+#: Upper bound on TCP connect probes in flight across a whole scan. Every host
+#: worker shares this one pool, so --scan-ports cannot create
+#: threads x ports probe threads.
+MAX_PORT_PROBE_WORKERS = 128
+
 
 @dataclass(frozen=True)
 class ScanConfig:
@@ -65,32 +70,27 @@ def execute_scan(
     cache = HostnameCache(config.dns_cache_ttl) if config.resolve else None
     results: List[HostResult] = []
 
+    port_executor: Optional[concurrent.futures.ThreadPoolExecutor] = None
+    if config.scan_ports and config.ports:
+        port_executor = concurrent.futures.ThreadPoolExecutor(
+            max_workers=min(MAX_PORT_PROBE_WORKERS, config.threads * len(config.ports)),
+            thread_name_prefix="ipmg-port",
+        )
+
     executor = concurrent.futures.ThreadPoolExecutor(max_workers=config.threads)
     try:
-        futures = {executor.submit(ping_ip, ip, config.timeout, config.count): ip for ip in ips}
+        futures = [executor.submit(_probe_host, ip, config, cache, port_executor) for ip in ips]
 
         for future in concurrent.futures.as_completed(futures):
             if should_stop is not None and should_stop():
                 executor.shutdown(wait=False, cancel_futures=True)
                 break
 
-            ip = futures[future]
             try:
-                status, latency = future.result()
+                result = future.result()
             except PingError:
                 executor.shutdown(wait=False, cancel_futures=True)
                 raise
-            except Exception:
-                status, latency = "Error", None
-
-            hostname = cache.resolve(ip) if cache else ""
-            open_ports: Tuple[int, ...] = ()
-            if config.scan_ports and status == "Active":
-                open_ports = tuple(scan_ports(ip, config.ports, config.port_timeout))
-
-            result = HostResult(
-                ip=ip, status=status, latency=latency, hostname=hostname, open_ports=open_ports
-            )
             results.append(result)
 
             if on_result is not None:
@@ -103,5 +103,38 @@ def execute_scan(
         raise
     finally:
         executor.shutdown(wait=True)
+        if port_executor is not None:
+            port_executor.shutdown(wait=True)
 
     return results
+
+
+def _probe_host(
+    ip: str,
+    config: ScanConfig,
+    cache: Optional[HostnameCache],
+    port_executor: Optional[concurrent.futures.Executor],
+) -> HostResult:
+    """Ping one host, then resolve its name and probe its ports.
+
+    Runs on a pool worker, so reverse DNS is spread across ``config.threads``
+    workers instead of running one host at a time on the thread that collects
+    results. Port probes go to the scan's shared, bounded ``port_executor``.
+    """
+    try:
+        status, latency = ping_ip(ip, config.timeout, config.count)
+    except PingError:
+        raise
+    except Exception:
+        status, latency = "Error", None
+
+    hostname = cache.resolve(ip) if cache else ""
+    open_ports: Tuple[int, ...] = ()
+    if config.scan_ports and status == "Active":
+        open_ports = tuple(
+            scan_ports(ip, config.ports, config.port_timeout, executor=port_executor)
+        )
+
+    return HostResult(
+        ip=ip, status=status, latency=latency, hostname=hostname, open_ports=open_ports
+    )

{ipmg-2.1.0 → ipmg-2.2.0}/src/ipmg/core/portscan.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import concurrent.futures
 import socket
-from typing import Iterable, List, Tuple
+from typing import Iterable, List, Optional, Tuple
 
 #: Common services worth a quick TCP connect once a host is known to be up.
 DEFAULT_PORTS: Tuple[int, ...] = (21, 22, 25, 53, 80, 443, 445, 1433, 3306, 3389, 5432)
@@ -65,18 +65,27 @@ def parse_port_list(value: str) -> Tuple[int, ...]:
     return tuple(ports)
 
 
-def scan_ports(ip: str, ports: Iterable[int], timeout: float = 1.0) -> List[int]:
-    """Probe ``ports`` on ``ip`` concurrently; return the ones that accepted a connection."""
+def scan_ports(
+    ip: str,
+    ports: Iterable[int],
+    timeout: float = 1.0,
+    executor: Optional[concurrent.futures.Executor] = None,
+) -> List[int]:
+    """Probe ``ports`` on ``ip`` concurrently; return the ones that accepted a connection.
+
+    Pass ``executor`` to share one bounded pool across many hosts; otherwise a
+    pool with one worker per port is created for this call.
+    """
     ports = list(ports)
     if not ports:
         return []
 
-    with concurrent.futures.ThreadPoolExecutor(max_workers=len(ports)) as executor:
-        futures = {executor.submit(_probe, ip, port, timeout): port for port in ports}
-        open_ports = [
-            futures[future]
-            for future in concurrent.futures.as_completed(futures)
-            if future.result()
-        ]
+    if executor is None:
+        with concurrent.futures.ThreadPoolExecutor(max_workers=len(ports)) as own:
+            return scan_ports(ip, ports, timeout, executor=own)
 
+    futures = {executor.submit(_probe, ip, port, timeout): port for port in ports}
+    open_ports = [
+        futures[future] for future in concurrent.futures.as_completed(futures) if future.result()
+    ]
     return sorted(open_ports)

{ipmg-2.1.0 → ipmg-2.2.0}/src/ipmg/infrastructure/incremental.py

@@ -17,23 +17,32 @@ writes at the end of the pass, which is why the scan shares its timestamp with
 the writer. A completed scan overwrites every snapshot with the canonical
 report, so incremental writing changes what survives an interruption without
 changing what a finished scan produces.
+
+That partial report is also where an interrupted scan picks up again:
+:func:`load_partial_report` reads the hosts it already holds, and ``--resume``
+scans only the rest, writing to the same files under the same timestamp.
 """
 
 from __future__ import annotations
 
+import io
 import json
 import logging
+import math
 import os
+import re
 import time
 from dataclasses import dataclass
+from datetime import datetime
 from pathlib import Path
-from typing import IO, Dict, List, Optional, Sequence
+from typing import IO, Dict, List, Optional, Sequence, Set, Tuple
 
 import pandas as pd
 
 from ipmg.core.engine import HostResult
+from ipmg.exceptions import FileIOError
 from ipmg.reporting.frames import RESULT_COLUMNS, format_open_ports
-from ipmg.utils.helpers import spreadsheet_escape
+from ipmg.utils.helpers import FORMULA_PREFIXES, spreadsheet_escape
 
 log = logging.getLogger(__name__)
 
@@ -48,6 +57,12 @@ REPORT_FORMATS = ("xlsx", "csv", "json", "jsonl", "md")
 STREAMING_FORMATS = ("csv", "jsonl")
 #: Formats that only exist as a whole file, so they are re-snapshotted.
 SNAPSHOT_FORMATS = ("xlsx", "json", "md")
+#: Formats a scan can be resumed from, most faithful first. ``md`` only
+#: previews the first 25 hosts, so it cannot stand in for the whole report.
+RESUMABLE_FORMATS = ("jsonl", "csv", "json", "xlsx")
+
+#: ``<base>_<YYYYMMDD_HHMMSS>.<format>``, the name every report is saved under.
+_REPORT_NAME = re.compile(r"^(?P<prefix>.+)_(?P<timestamp>\d{8}_\d{6})\.(?P<fmt>[a-z]+)$")
 
 
 @dataclass(frozen=True)
@@ -120,6 +135,7 @@ class IncrementalReport:
         batch_timestamp: object,
         options: IncrementalOptions = IncrementalOptions(),
         previous: Optional[Sequence[HostResult]] = None,
+        previous_elapsed_s: float = 0.0,
     ) -> None:
         self.options = options.clamped()
         self._base = base
@@ -127,13 +143,17 @@ class IncrementalReport:
         self._batch_timestamp = batch_timestamp
         self._formats = [fmt for fmt in dict.fromkeys(formats)]
         self._results: List[HostResult] = list(previous or ())
+        # Resumed rows keep the time the earlier run had reached, and new rows
+        # count on from it, so a report interrupted twice still knows how long
+        # the whole scan has taken.
         self._rows: List[Dict[str, object]] = [
-            result_row(result, batch_timestamp, None) for result in self._results
+            result_row(result, batch_timestamp, previous_elapsed_s if previous else None)
+            for result in self._results
         ]
         self._handles: Dict[str, IO[str]] = {}
         self._written: Dict[str, None] = {}
-        self._started_at = time.monotonic()
-        self._last_snapshot = self._started_at
+        self._started_at = time.monotonic() - previous_elapsed_s
+        self._last_snapshot = time.monotonic()
         self._closed = False
 
     # -- lifecycle ---------------------------------------------------------
@@ -259,6 +279,194 @@ class IncrementalReport:
         self._handles.clear()
 
 
+@dataclass(frozen=True)
+class PartialReport:
+    """The hosts an interrupted scan left in its report, ready to resume."""
+
+    path: str
+    #: The ``--output`` prefix and timestamp the report was saved under, so a
+    #: resumed scan writes back to the same files.
+    base: str
+    timestamp: str
+    results: Tuple[HostResult, ...]
+    batch_timestamp: Optional[datetime]
+    #: How long the earlier run had been scanning when it stopped.
+    elapsed_s: float
+
+    @property
+    def scanned(self) -> Set[str]:
+        return {result.ip for result in self.results}
+
+
+def find_partial_report(base: str) -> Optional[str]:
+    """The newest report saved under ``base`` that a scan can resume from.
+
+    When one scan left several formats behind, the most faithful one wins:
+    ``jsonl`` and ``csv`` hold every host up to the moment of interruption,
+    while ``json`` and ``xlsx`` are only as recent as their last autosave.
+    """
+    directory = Path(base).parent
+    prefix = Path(base).name
+    candidates = []
+    try:
+        entries = list(directory.iterdir())
+    except OSError:
+        return None
+    for entry in entries:
+        match = _REPORT_NAME.match(entry.name)
+        if not match or match["prefix"] != prefix or match["fmt"] not in RESUMABLE_FORMATS:
+            continue
+        rank = RESUMABLE_FORMATS.index(match["fmt"])
+        candidates.append((match["timestamp"], -rank, str(entry)))
+    return max(candidates)[2] if candidates else None
+
+
+def load_partial_report(path: str) -> PartialReport:
+    """Read the hosts a report already holds, including one cut off mid-write."""
+    name = _REPORT_NAME.match(Path(path).name)
+    if name is None:
+        raise FileIOError(
+            f"Cannot resume from {path}: expected a report named like "
+            "results_20260917_120000.jsonl, as IPMG saves them."
+        )
+    fmt = name["fmt"]
+    if fmt not in RESUMABLE_FORMATS:
+        raise FileIOError(
+            f"Cannot resume from a .{fmt} report; use the "
+            f"{', '.join(RESUMABLE_FORMATS)} report from the same scan instead."
+        )
+
+    try:
+        frame = _read_report(path, fmt)
+    except FileNotFoundError:
+        raise FileIOError(f"Report to resume not found: {path}") from None
+    except (OSError, ValueError) as exc:
+        raise FileIOError(f"Cannot read report {path}: {exc}") from exc
+
+    missing = [column for column in ("IP Address", "Status") if column not in frame.columns]
+    if missing:
+        raise FileIOError(f"{path} is not an IPMG report: missing {', '.join(missing)}.")
+
+    # A spreadsheet format stores cells escaped against formula injection;
+    # the scan itself needs the text the host actually reported.
+    unescape = fmt in ("csv", "xlsx")
+    by_ip: Dict[str, HostResult] = {}
+    for row in frame.to_dict(orient="records"):
+        result = _row_result(row, unescape)
+        if result is not None:
+            by_ip[result.ip] = result
+
+    base = str(Path(path).parent / name["prefix"])
+    return PartialReport(
+        path=path,
+        base=base,
+        timestamp=name["timestamp"],
+        results=tuple(by_ip.values()),
+        batch_timestamp=_batch_timestamp(frame),
+        elapsed_s=_elapsed(frame),
+    )
+
+
+def _read_report(path: str, fmt: str) -> pd.DataFrame:
+    if fmt == "xlsx":
+        return pd.read_excel(path, dtype=object)
+    if fmt == "json":
+        with open(path, encoding="utf-8") as handle:
+            return pd.DataFrame(json.load(handle))
+
+    with open(path, encoding="utf-8", newline="") as handle:
+        text = handle.read()
+    # Rows are flushed whole, so a last line without its newline is one the
+    # previous run was killed while writing. It is dropped, and that host is
+    # simply scanned again.
+    if text and not text.endswith("\n"):
+        text = text[: text.rfind("\n") + 1]
+
+    if fmt == "csv":
+        if not text.strip():
+            return pd.DataFrame(columns=RESULT_COLUMNS)
+        return pd.read_csv(io.StringIO(text), dtype=str, keep_default_na=False)
+
+    records = []
+    for number, line in enumerate(text.splitlines(), start=1):
+        if not line.strip():
+            continue
+        try:
+            records.append(json.loads(line))
+        except json.JSONDecodeError as exc:
+            raise ValueError(f"line {number} is not valid JSON ({exc.msg})") from None
+    return pd.DataFrame(records)
+
+
+def _is_blank(value: object) -> bool:
+    return value is None or (isinstance(value, float) and math.isnan(value)) or value == ""
+
+
+def _text(value: object, unescape: bool = False) -> str:
+    if _is_blank(value):
+        return ""
+    text = str(value).strip()
+    if unescape and text.startswith("'") and text[1:].startswith(FORMULA_PREFIXES):
+        return text[1:]
+    return text
+
+
+def _latency(value: object) -> Optional[float]:
+    if _is_blank(value):
+        return None
+    try:
+        return float(value)  # type: ignore[arg-type]
+    except (TypeError, ValueError):
+        return None
+
+
+def _open_ports(value: object) -> Tuple[int, ...]:
+    ports = []
+    for piece in _text(value).split(","):
+        try:
+            ports.append(int(float(piece)))
+        except ValueError:
+            continue
+    return tuple(ports)
+
+
+def _row_result(row: Dict[str, object], unescape: bool) -> Optional[HostResult]:
+    ip = _text(row.get("IP Address"))
+    status = _text(row.get("Status"))
+    if not ip or not status:
+        return None
+    return HostResult(
+        ip=ip,
+        status=status,
+        latency=_latency(row.get("Latency")),
+        hostname=_text(row.get("Hostname"), unescape),
+        open_ports=_open_ports(row.get("Open Ports")),
+    )
+
+
+def _batch_timestamp(frame: pd.DataFrame) -> Optional[datetime]:
+    """The resumed scan's start time, so both runs report as one batch."""
+    if "Batch Timestamp" not in frame.columns:
+        return None
+    for value in frame["Batch Timestamp"]:
+        if _is_blank(value):
+            continue
+        try:
+            # A finished json report stores it as epoch milliseconds.
+            unit = "ms" if isinstance(value, (int, float)) else None
+            return pd.to_datetime(value, unit=unit).to_pydatetime()
+        except (TypeError, ValueError, OverflowError):
+            return None
+    return None
+
+
+def _elapsed(frame: pd.DataFrame) -> float:
+    if "Scan Duration (s)" not in frame.columns:
+        return 0.0
+    durations = pd.to_numeric(frame["Scan Duration (s)"], errors="coerce").dropna()
+    return float(durations.max()) if not durations.empty else 0.0
+
+
 def atomic_write_bytes(path: str, data: bytes) -> None:
     """Replace ``path`` with ``data`` in one step, or leave it untouched.
 

{ipmg-2.1.0 → ipmg-2.2.0}/src/ipmg/reporting/ui.py

@@ -111,7 +111,8 @@ def heading(title: str) -> None:
 def field(label: str, value: object, value_style: str = "ipmg.value") -> None:
     """One aligned ``label   value`` line."""
     text = Text(INDENT)
-    text.append(f"{label:<{LABEL_WIDTH}}", style="ipmg.label")
+    # A label as long as the column still gets one space before its value.
+    text.append(f"{label:<{LABEL_WIDTH - 1}} ", style="ipmg.label")
     text.append(str(value), style=value_style)
     console.print(text)