osintkit 0.1.1__tar.gz

osintkit-0.1.1/.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml,json,md}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

osintkit-0.1.1/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+* @sjdsjadjajdjsa
+
+docs/ @sjdsjadjajdjsa

osintkit-0.1.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,57 @@
+name: Bug report
+description: Something broke or lied
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Never paste a live API key. Trim personal data from reports where you can.
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output of `osintkit --version`
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command
+      description: Redact the target if it is sensitive
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual
+      description: Paste the error or the coverage panel
+    validations:
+      required: true
+  - type: dropdown
+    id: source
+    attributes:
+      label: Area
+      options:
+        - collector / source
+        - synthesis / model
+        - rendering / output
+        - cache / storage
+        - CLI / UX
+        - packaging / install
+        - other
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: Reproduced on the latest main
+        - label: osintkit doctor output included (key length only)

osintkit-0.1.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/sjdsjadjajdjsa/osintkit/security/advisories/new
+    about: Private disclosure for key leaks, cache poisoning, injection, and SSRF

osintkit-0.1.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: A source, output, or behaviour worth adding
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What is awkward today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+    validations:
+      required: true
+  - type: input
+    id: source
+    attributes:
+      label: Source
+      description: If this is a data source, link it and confirm it needs no login
+  - type: checkboxes
+    id: constraints
+    attributes:
+      label: Constraints
+      options:
+        - label: The source is public and login-free
+        - label: The output can be represented in the existing JSON schema
+        - label: I am willing to open a PR

osintkit-0.1.1/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev:
+        patterns: ["*"]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

osintkit-0.1.1/.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Problem
+
+<!-- What is wrong or missing today? -->
+
+## Change
+
+<!-- What does this do, and why this way? -->
+
+## Testing
+
+<!-- Commands run, sources exercised, and the report or coverage panel for collector changes. -->
+
+- [ ] `pytest` passes
+- [ ] `uvx ruff check src tests` and `uvx ruff format --check src tests` pass
+- [ ] no live credentials or captured personal data in the diff
+- [ ] docs updated for new flags, collectors, or behaviour

osintkit-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Set up Python
+        run: uv python install ${{ matrix.python-version }}
+      - name: Install
+        run: |
+          uv venv --python ${{ matrix.python-version }}
+          uv sync --frozen --extra dev
+      - name: Lint
+        run: |
+          uvx ruff check src tests
+          uvx ruff format --check src tests
+      - name: Test
+        run: .venv/bin/pytest -q --cov=osintkit --cov-fail-under=85

osintkit-0.1.1/.github/workflows/codeql.yml

@@ -0,0 +1,25 @@
+name: codeql
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  security-events: write
+  actions: read
+  contents: read
+
+jobs:
+  analyze:
+    if: github.event.repository.private == false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          queries: security-extended
+      - uses: github/codeql-action/analyze@v4

osintkit-0.1.1/.github/workflows/publish.yml

@@ -0,0 +1,29 @@
+name: publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  pypi:
+    if: vars.PUBLISH_TO_PYPI == 'true'
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Build
+        run: |
+          uv python install 3.12
+          uv venv --python 3.12
+          uv sync --frozen --no-dev
+          uv pip install build
+          .venv/bin/python -m build --outdir dist
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist

osintkit-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,36 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Build
+        run: |
+          uv python install 3.12
+          uv venv --python 3.12
+          uv sync --frozen
+          uv pip install build
+          .venv/bin/python -m build --outdir dist
+      - name: Verify the tag matches the package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(.venv/bin/python -c 'import osintkit; print(osintkit.__version__)')"
+          test "$tag" = "$version" || { echo "tag $tag != version $version"; exit 1; }
+      - name: Checksums
+        run: |
+          cd dist
+          sha256sum osintkit-*.whl osintkit-*.tar.gz > SHA256SUMS.txt
+      - uses: softprops/action-gh-release@v3
+        with:
+          files: |
+            dist/*
+          generate_release_notes: true

osintkit-0.1.1/.github/workflows/smoke.yml

@@ -0,0 +1,38 @@
+name: smoke
+
+on:
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  collectors:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Install
+        run: |
+          uv venv --python 3.12
+          uv sync --frozen --no-dev
+      - name: Collect against stable targets
+        run: |
+          set -eu
+          for target in example.com cloudflare.com; do
+            .venv/bin/osintkit --no-cache lookup --domain "$target" --raw \
+              --only dns_records,dns_mail_posture,crt_sh_subdomains > "smoke-$target.json"
+            .venv/bin/python - "smoke-$target.json" <<'PY'
+          import json, sys
+
+          payload = json.load(open(sys.argv[1]))
+          results = payload["results"]
+          ok = [r for r in results if r["ok"] and r["data"]]
+          if not ok:
+              print("every collector failed", file=sys.stderr)
+              raise SystemExit(1)
+          print(f"{len(ok)}/{len(results)} collectors returned data")
+          PY
+          done

osintkit-0.1.1/.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+.crush/
+DS_Store

osintkit-0.1.1/.mailmap

@@ -0,0 +1 @@
+sjdsjadjajdjsa <sjdsjadjajdjsa@users.noreply.github.com> <dev@osintkit.local>

osintkit-0.1.1/.pre-commit-config.yaml

@@ -0,0 +1,7 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.0
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format

osintkit-0.1.1/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes are recorded here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Unreleased
+
+## 0.1.1 — 2026-11-02
+
+### Added
+
+- `--provider` presets (`venice`, `openrouter`, `openai`) chosen from a key prefix
+- `collectors --json` metadata for scripting
+- weekly smoke workflow and a social preview card
+- opt-in PyPI publishing through Trusted Publishing
+
+### Changed
+
+- default Venice model is the plain `deepseek-v4-1-flash` alias
+- the README demo image no longer names the model
+- CI enforces formatting and 85% coverage
+
+### Added
+
+- `diff` command comparing two archived runs: risk direction, breach and subdomain deltas,
+  collector health
+- `--ports` to scope the TCP probe list
+- provider detection from a `sk-or-` key prefix
+- `doctor --deep` verifying the key with a one-token completion
+- retention window and `prune` for cache, logs, and reports
+- `schema` command publishing the model contract
+- `batch --only`, `--skip`, `--raw`, and `--concurrency`
+
+### Changed
+
+- breach records merge across sources; risk gets a deterministic floor
+- report schema carries `schema_version`
+- unknown collector names fail with a suggestion
+
+### Fixed
+
+- repeat runs missed the model cache because of a prompt timestamp
+- cached replays double-decoded compressed bodies
+- crt.sh organisation search falls back to certificate identity
+- batch progress no longer pollutes piped JSON
+- rate-limit and empty-completion handling
+
+## 0.1.0 — 2026-11-02
+
+Initial release: lookup, batch, and history commands; twenty public-source collectors;
+LLM synthesis with schema validation; Rich, JSON, and Markdown output; local cache and logs.

osintkit-0.1.1/CODE_OF_CONDUCT.md

@@ -0,0 +1,34 @@
+# Code of conduct
+
+Adapted from the Contributor Covenant, version 2.1.
+
+## Our pledge
+
+We make participation in this project harassment-free for everyone, regardless of experience,
+identity, or background.
+
+## Expected behaviour
+
+- Be direct and kind. Critique the change, not the person.
+- Assume good faith; ask before rewriting someone else's work.
+- Accept that "no, and here is why" is a complete answer.
+- Credit prior art and other people's findings.
+
+## Unacceptable behaviour
+
+- Harassment, insults, or dismissive gatekeeping.
+- Publishing others' private data without consent (fits this project especially).
+- Sustained off-topic noise in issues or pull requests.
+- Plagiarism or uncredited vendoring.
+
+## Scope
+
+Issues, pull requests, discussions, and anywhere the project is represented.
+
+## Enforcement
+
+Report by opening an issue or tagging the maintainer in the thread. Consequences scale with the
+offence: a nudge, a comment cleanup, or removal from the project. Decisions are explained, and
+appeals are heard once.
+
+Maintainers may edit or delete contributions that break these rules.

osintkit-0.1.1/CONTRIBUTING.md

@@ -0,0 +1,69 @@
+# Contributing
+
+Bug reports and pull requests are welcome. By participating you agree to the
+[Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Setup
+
+```bash
+git clone https://github.com/sjdsjadjajdjsa/osintkit
+cd osintkit
+uv sync --extra dev
+pre-commit install
+pytest
+```
+
+Tests must not touch the network. HTTP is mocked with `respx`; DNS, WHOIS, and model calls are
+monkeypatched. `tests/fixtures/model_reply.json` covers the full-stack path.
+
+## What fits
+
+- new login-free, publicly documented sources
+- parser fixes when a source changes shape
+- better failure messages, caching, or rate-limit handling
+- accessibility and output quality in the Rich renderer
+- documentation, examples, and tests
+
+Out of scope: sources that need scraping behind a login, paid brokers, and broad rewrites of the
+CLI surface.
+
+## Adding a collector
+
+Collectors are small async functions in `src/osintkit/collectors/`.
+
+1. Register with `@collector(name, target_types, description, order=..., ttl=..., timeout=...)`.
+2. Accept `Context`; read only `ctx.target`, `ctx.target_type`, `ctx.http`, and settings.
+3. Return plain JSON-able data. Raise nothing for a normal empty result.
+4. Pass a `namespace` to every `ctx.http` call so caching is isolated. Use `empty_on` for
+   "not found" statuses.
+5. Add a `ttl` for volatile data and a `timeout` for slow sources.
+6. Test the happy path, the empty path, and one failure path with `respx`.
+7. Add the row to `docs/REFERENCE.md#collectors`.
+
+`run_collector` catches exceptions, times the call, and records the outcome, so a collector must
+only raise for genuinely broken upstream state.
+
+Never invent data: if a source returns nothing, return an empty value. The synthesis prompt
+distinguishes "no findings" from "not collected", and both are visible in the report.
+
+## Style
+
+- `ruff format` and `ruff check` must pass; line length 112.
+- Type hints on public functions; `from __future__ import annotations` at the top.
+- Comments explain *why*, not *what*. Docstrings for modules and non-obvious functions.
+- No new runtime dependency without a reason in the PR.
+- Keep the security posture: public data only, no credentials in logs, no shelling out.
+
+## Commits
+
+Present tense, imperative, under 72 characters on the first line. Say what the change enables,
+not which files moved. Body only when the reason is not obvious.
+
+## Pull requests
+
+- One logical change per PR; split unrelated cleanups out.
+- Describe the problem before the fix, and say how it was tested.
+- Include the report or coverage panel for collector changes.
+- CI must be green; `--no-verify` is fine locally but not for merging.
+
+Maintainers may squash. A reviewer will ask for a test if a change is behavioural and untested.

osintkit-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 osintkit contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.