osintkit 0.1.1__tar.gz → 0.2.0__tar.gz

{osintkit-0.1.1 → osintkit-0.2.0}/.github/workflows/release.yml

@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: write
+  actions: write
 
 jobs:
   build:
@@ -34,3 +35,8 @@ jobs:
           files: |
             dist/*
           generate_release_notes: true
+      - name: Trigger PyPI publish
+        if: vars.PUBLISH_TO_PYPI == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run publish.yml --ref "${GITHUB_REF_NAME}" --repo "$GITHUB_REPOSITORY"

{osintkit-0.1.1 → osintkit-0.2.0}/CHANGELOG.md

@@ -6,6 +6,23 @@ All notable changes are recorded here. The format follows
 
 ## Unreleased
 
+## 0.2.0 — 2026-11-02
+
+### Added
+
+- `--offline` mode: a full report built from local rules, no model and no key
+
+### Fixed
+
+- the ports collector was registered as a sync helper, so `--ports` and the registry entry broke
+
+## 0.1.2 — 2026-11-02
+
+### Fixed
+
+- releases now dispatch the PyPI job explicitly, since `GITHUB_TOKEN` releases do not fire
+  `release` events
+
 ## 0.1.1 — 2026-11-02
 
 ### Added

{osintkit-0.1.1 → osintkit-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: osintkit
-Version: 0.1.1
+Version: 0.2.0
 Summary: Public-data OSINT aggregator for emails, usernames, domains, and companies
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/osintkit
 Project-URL: Issues, https://github.com/sjdsjadjajdjsa/osintkit/issues
@@ -34,6 +34,7 @@ Description-Content-Type: text/markdown
 
 [![ci](https://github.com/sjdsjadjajdjsa/osintkit/actions/workflows/ci.yml/badge.svg)](https://github.com/sjdsjadjajdjsa/osintkit/actions/workflows/ci.yml)
 [![python](https://img.shields.io/badge/python-3.12%20%7C%203.13-blue)](pyproject.toml)
+[![pypi](https://img.shields.io/pypi/v/osintkit)](https://pypi.org/project/osintkit/)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 
@@ -62,14 +63,13 @@ on a domain or company. Findings are leads to verify, not facts.
 ## Install
 
 ```bash
-uv tool install git+https://github.com/sjdsjadjajdjsa/osintkit
+pipx install osintkit
 # or
-pipx install git+https://github.com/sjdsjadjajdjsa/osintkit
+uv tool install osintkit
 ```
 
-[Releases](https://github.com/sjdsjadjajdjsa/osintkit/releases) carry a signed-checksum wheel;
-`pip install osintkit-0.1.0-py3-none-any.whl` works from one. From a clone,
-`pip install -e .` also works. Python 3.12+ only.
+Every [release](https://github.com/sjdsjadjajdjsa/osintkit/releases) also carries a wheel with
+checksums, and `pip install -e .` works from a clone. Python 3.12+ only.
 
 ## Quick start
 
@@ -79,8 +79,9 @@ osintkit doctor --deep             # prove the key and endpoint work
 osintkit lookup alice@example.com
 ```
 
-No key? `osintkit lookup example.com --raw` still collects everything; `--dry-run` shows the
-exact synthesis prompt.
+No key? `osintkit lookup example.com --offline` builds the whole report locally from rule checks,
+no model involved. `--raw` gives the collected JSON and `--dry-run` prints the prompt a model
+would receive.
 
 Any OpenAI-compatible endpoint works. `--provider venice|openrouter|openai` picks a preset, and
 a recognisable key prefix picks one for you; `--base-url` and `--model` always win.
@@ -102,7 +103,7 @@ Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts G
 | `schema` | The JSON contract the model must satisfy |
 
 Output: default colour report, `--json`, `--markdown` (they combine), `--raw` for collected
-data, `--dry-run` for the prompt. Exit codes: `0` ok, `1` synthesis or partial failure, `2` bad
+data, `--offline` for a local report with no model, `--dry-run` for the prompt. Exit codes: `0` ok, `1` synthesis or partial failure, `2` bad
 input.
 
 ## How it works
@@ -115,6 +116,7 @@ target -> type detection -> collectors (parallel, cached, retried)
                                  |
                                  v
            LLM briefing -> pydantic validation -> one repair retry
+                                 |            (--offline replaces this with local rules)
                                  |
                                  v
               colour report . JSON . Markdown . archive

{osintkit-0.1.1 → osintkit-0.2.0}/README.md

@@ -2,6 +2,7 @@
 
 [![ci](https://github.com/sjdsjadjajdjsa/osintkit/actions/workflows/ci.yml/badge.svg)](https://github.com/sjdsjadjajdjsa/osintkit/actions/workflows/ci.yml)
 [![python](https://img.shields.io/badge/python-3.12%20%7C%203.13-blue)](pyproject.toml)
+[![pypi](https://img.shields.io/pypi/v/osintkit)](https://pypi.org/project/osintkit/)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 
@@ -30,14 +31,13 @@ on a domain or company. Findings are leads to verify, not facts.
 ## Install
 
 ```bash
-uv tool install git+https://github.com/sjdsjadjajdjsa/osintkit
+pipx install osintkit
 # or
-pipx install git+https://github.com/sjdsjadjajdjsa/osintkit
+uv tool install osintkit
 ```
 
-[Releases](https://github.com/sjdsjadjajdjsa/osintkit/releases) carry a signed-checksum wheel;
-`pip install osintkit-0.1.0-py3-none-any.whl` works from one. From a clone,
-`pip install -e .` also works. Python 3.12+ only.
+Every [release](https://github.com/sjdsjadjajdjsa/osintkit/releases) also carries a wheel with
+checksums, and `pip install -e .` works from a clone. Python 3.12+ only.
 
 ## Quick start
 
@@ -47,8 +47,9 @@ osintkit doctor --deep             # prove the key and endpoint work
 osintkit lookup alice@example.com
 ```
 
-No key? `osintkit lookup example.com --raw` still collects everything; `--dry-run` shows the
-exact synthesis prompt.
+No key? `osintkit lookup example.com --offline` builds the whole report locally from rule checks,
+no model involved. `--raw` gives the collected JSON and `--dry-run` prints the prompt a model
+would receive.
 
 Any OpenAI-compatible endpoint works. `--provider venice|openrouter|openai` picks a preset, and
 a recognisable key prefix picks one for you; `--base-url` and `--model` always win.
@@ -70,7 +71,7 @@ Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts G
 | `schema` | The JSON contract the model must satisfy |
 
 Output: default colour report, `--json`, `--markdown` (they combine), `--raw` for collected
-data, `--dry-run` for the prompt. Exit codes: `0` ok, `1` synthesis or partial failure, `2` bad
+data, `--offline` for a local report with no model, `--dry-run` for the prompt. Exit codes: `0` ok, `1` synthesis or partial failure, `2` bad
 input.
 
 ## How it works
@@ -83,6 +84,7 @@ target -> type detection -> collectors (parallel, cached, retried)
                                  |
                                  v
            LLM briefing -> pydantic validation -> one repair retry
+                                 |            (--offline replaces this with local rules)
                                  |
                                  v
               colour report . JSON . Markdown . archive

{osintkit-0.1.1 → osintkit-0.2.0}/docs/REFERENCE.md

@@ -49,9 +49,16 @@ Explicit `--base-url` and `--model` beat both the provider and the prefix. Tempe
 `--max-connections`, `--max-attempts`, `--no-cache`, `--cache-ttl`, `--resolver` (repeatable),
 `-v/--verbose`, `--version`.
 
-Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--dry-run`, `--only`, `--skip`,
+Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--offline`, `--dry-run`, `--only`, `--skip`,
 `--ports`, `--fail-fast`, `-c/--concurrency`, `--limit`, `--show`, `--days`, `--clear`, `--deep`.
 
+## Offline mode
+
+`--offline` skips the model: breaches, accounts, hosts, and policy gaps are rendered from the
+collected data, risk comes from the same deterministic floor (plus open risky ports and a
+wildcard with no DMARC), and recommendations come from rule checks. Summary text says what was
+and was not collected. Useful without a key, in CI, and when a provider is down.
+
 ## Output contract
 
 `osintkit schema` prints the JSON Schema. Synthesis must return `summary`, `breaches[]`,
@@ -103,10 +110,12 @@ if every collector breaks, so upstream parser rot surfaces without a nightly ful
 
 ## Publishing
 
-`.github/workflows/publish.yml` builds and uploads to PyPI on a published release, using Trusted
-Publishing (OIDC, `pypi` environment, no token). It is inert until you:
+Releases publish to PyPI through Trusted Publishing (OIDC, `pypi` environment, no token).
 
-1. Create the project on PyPI and add a trusted publisher for this repo and the `pypi` environment.
-2. Set the repository variable `PUBLISH_TO_PYPI=true`.
+The chain: `release.yml` builds, attaches assets, then dispatches `publish.yml` when the
+repository variable `PUBLISH_TO_PYPI` is `true`. The dispatch is needed because releases created
+by `GITHUB_TOKEN` do not fire `release` events.
 
-Until then, releases attach wheel and sdist assets to GitHub itself.
+To fail safely, `publish.yml` is skipped unless that variable is set and the PyPI pending
+publisher matches owner `sjdsjadjajdjsa`, repository `osintkit`, workflow `publish.yml`, and
+environment `pypi`.

{osintkit-0.1.1 → osintkit-0.2.0}/examples/README.md

@@ -36,3 +36,10 @@ Narrow a port scan:
 ```bash
 osintkit lookup --domain example.com --only tcp_ports --ports 22,443
 ```
+
+No key at all:
+
+```bash
+osintkit lookup --domain example.com --offline
+osintkit batch --file targets.csv --offline --json
+```

{osintkit-0.1.1 → osintkit-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "osintkit"
-version = "0.1.1"
+version = "0.2.0"
 description = "Public-data OSINT aggregator for emails, usernames, domains, and companies"
 readme = "README.md"
 requires-python = ">=3.12"

{osintkit-0.1.1 → osintkit-0.2.0}/src/osintkit/__init__.py

@@ -1,3 +1,3 @@
 """osintkit: a public-data OSINT aggregator."""
 
-__version__ = "0.1.1"
+__version__ = "0.2.0"

{osintkit-0.1.1 → osintkit-0.2.0}/src/osintkit/cli.py

@@ -235,13 +235,20 @@ def lookup(
     out_path: Path | None = typer.Option(None, "--out", "-o", help="Markdown destination."),
     dry_run: bool = typer.Option(False, "--dry-run", help="Print the prompt, skip the model."),
     raw: bool = typer.Option(False, "--raw", help="Dump collected data as JSON, skip the model."),
+    offline: bool = typer.Option(False, "--offline", help="Report from collected data only; no model, no key."),
     only: list[str] | None = typer.Option(None, "--only", help="Run only these collectors."),
     skip: list[str] | None = typer.Option(None, "--skip", help="Skip these collectors."),
     ports: list[str] | None = typer.Option(None, "--ports", help="Ports to probe, e.g. 22,443."),
 ) -> None:
     """Look up one target."""
     out = _console()
-    settings = _settings(output_json=json_out, output_markdown=markdown, dry_run=dry_run, raw=raw)
+    settings = _settings(
+        output_json=json_out,
+        output_markdown=markdown,
+        dry_run=dry_run,
+        raw=raw,
+        offline=offline,
+    )
     try:
         settings.extra["ports"] = _parse_ports(ports)
     except typer.BadParameter as exc:
@@ -317,6 +324,7 @@ def batch(
     out_dir: Path | None = typer.Option(None, "--out", "-o", help="Markdown output directory."),
     dry_run: bool = typer.Option(False, "--dry-run", help="Print prompts, skip the model."),
     raw: bool = typer.Option(False, "--raw", help="JSON array of collected data, skip the model."),
+    offline: bool = typer.Option(False, "--offline", help="Report from collected data only; no model, no key."),
     fail_fast: bool = typer.Option(False, "--fail-fast", help="Stop reporting at the first error."),
     concurrency: int = typer.Option(3, "--concurrency", "-c", min=1, max=10, help="Targets to run at once."),
     only: list[str] | None = typer.Option(None, "--only", help="Run only these collectors."),
@@ -325,7 +333,13 @@ def batch(
 ) -> None:
     """Run every target in a CSV."""
     out = _console()
-    settings = _settings(output_json=json_out, output_markdown=markdown, dry_run=dry_run, raw=raw)
+    settings = _settings(
+        output_json=json_out,
+        output_markdown=markdown,
+        dry_run=dry_run,
+        raw=raw,
+        offline=offline,
+    )
     try:
         settings.extra["ports"] = _parse_ports(ports)
     except typer.BadParameter as exc:

{osintkit-0.1.1 → osintkit-0.2.0}/src/osintkit/config.py

@@ -79,6 +79,7 @@ class Settings:
     cache_ttl: int = DEFAULT_CACHE_TTL
     resolvers: list[str] = field(default_factory=lambda: list(DEFAULT_RESOLVERS))
     dry_run: bool = False
+    offline: bool = False
     raw: bool = False
     output_json: bool = False
     output_markdown: bool = False

osintkit-0.2.0/src/osintkit/offline.py

@@ -0,0 +1,205 @@
+"""Build a report from collected data alone, with no model call."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .models import Analysis, AssociatedAccount, Breach, CollectorResult
+from .normalise import apply_floor, signals_for
+
+RISKY_PORTS = {
+    21: "FTP is plaintext",
+    23: "Telnet is plaintext",
+    445: "SMB should not face the internet",
+    3306: "MySQL is exposed",
+    5432: "PostgreSQL is exposed",
+    6379: "Redis is often unauthenticated",
+    9200: "Elasticsearch is often unauthenticated",
+    27017: "MongoDB is often unauthenticated",
+}
+MAX_SUBDOMAINS = 25
+
+
+def _data(results: list[CollectorResult], name: str) -> Any:
+    for result in results:
+        if result.collector == name and result.has_data:
+            return result.data
+    return None
+
+
+def _found_accounts(results: list[CollectorResult]) -> list[AssociatedAccount]:
+    accounts: list[AssociatedAccount] = []
+    presence = _data(results, "username_presence")
+    if isinstance(presence, dict):
+        for hit in presence.get("found") or []:
+            accounts.append(
+                AssociatedAccount(
+                    platform=str(hit.get("site")),
+                    url=hit.get("url"),
+                    handle=str(presence.get("handle") or ""),
+                    note="profile URL answers 200; ownership unconfirmed",
+                )
+            )
+    profile = _data(results, "github_profile")
+    if isinstance(profile, dict):
+        user = profile.get("profile") or {}
+        if user.get("login"):
+            accounts.append(
+                AssociatedAccount(
+                    platform="GitHub",
+                    url=user.get("url"),
+                    handle=user.get("login"),
+                    note="returned by the GitHub API",
+                )
+            )
+    return accounts
+
+
+def _subdomains(results: list[CollectorResult]) -> list[str]:
+    names: list[str] = []
+    passive = _data(results, "passive_subdomains")
+    if isinstance(passive, dict):
+        names.extend(str(row.get("host")) for row in passive.get("live_hosts") or [])
+        names.extend(str(row.get("host")) for row in passive.get("common_prefix_hits") or [])
+    certs = _data(results, "crt_sh_subdomains")
+    if isinstance(certs, list):
+        names.extend(str(name) for name in certs)
+    seen: list[str] = []
+    for name in names:
+        if name not in seen:
+            seen.append(name)
+    return seen[:MAX_SUBDOMAINS]
+
+
+def _infrastructure(results: list[CollectorResult], report_notes: list[str]) -> list[str]:
+    notes: list[str] = []
+    mail = _data(results, "dns_mail_posture")
+    if isinstance(mail, dict):
+        if mail.get("spf_present"):
+            notes.append(f"SPF present, all-qualifier {mail.get('spf_all') or 'unknown'}")
+        else:
+            notes.append("No SPF record: sender enforcement is missing")
+        if mail.get("dmarc_present"):
+            notes.append(f"DMARC present with policy {mail.get('dmarc_policy') or 'unknown'}")
+        else:
+            notes.append("No DMARC record: spoofing is not instructed")
+        selectors = mail.get("dkim_selectors_found") or []
+        if selectors:
+            notes.append(f"{len(selectors)} DKIM selectors answer")
+
+    wildcard = _data(results, "dns_wildcard")
+    if isinstance(wildcard, dict) and wildcard.get("wildcard"):
+        notes.append("Wildcard DNS is enabled, so unknown labels resolve")
+
+    whois = _data(results, "whois_registration")
+    if isinstance(whois, dict) and whois.get("registrar"):
+        parts = [f"registrar {whois['registrar']}"]
+        if whois.get("creation_date"):
+            parts.append(f"registered {whois['creation_date']}")
+        if whois.get("expiration_date"):
+            parts.append(f"expires {whois['expiration_date']}")
+        notes.append(", ".join(parts))
+
+    ports = _data(results, "tcp_ports")
+    if isinstance(ports, dict):
+        for entry in ports.get("open") or []:
+            port = entry.get("port")
+            if port in RISKY_PORTS:
+                notes.append(f"port {port} open: {RISKY_PORTS[port]}")
+        if not ports.get("open"):
+            notes.append("No probed port accepted a connection")
+
+    dns = _data(results, "dns_records")
+    if isinstance(dns, dict) and dns.get("MX") == ["0 ."]:
+        notes.append("Null MX: the domain accepts no mail")
+    notes.extend(report_notes)
+    return notes
+
+
+def _recommendations(
+    creds: int, mail: dict | None, wildcard: bool, ports: list[int], breach_count: int
+) -> list[str]:
+    recs: list[str] = []
+    if creds:
+        recs.append("Rotate passwords for the affected services and enable MFA where offered")
+    elif breach_count:
+        recs.append("Confirm whether the breach set carries credentials before rotating")
+    if mail is not None:
+        if not mail.get("dmarc_present"):
+            recs.append("Publish a DMARC record, starting at p=none with reporting")
+        elif mail.get("dmarc_policy") in {"none", "quarantine"}:
+            recs.append(f"Move DMARC from p={mail.get('dmarc_policy')} to p=reject once reporting is clean")
+        if not mail.get("spf_present"):
+            recs.append("Publish an SPF record ending in -all")
+        elif mail.get("spf_all") != "-all":
+            recs.append("Tighten the SPF all-qualifier to -all")
+    if wildcard:
+        recs.append("Inventory wildcard-backed hostnames and remove ones no longer served")
+    if ports:
+        recs.append(f"Close or firewall public ports {', '.join(str(p) for p in ports)}")
+    if not recs:
+        recs.append("Re-run with a model key for a narrated briefing, or widen the collector set")
+    return recs
+
+
+def build(results: list[CollectorResult], report_notes: list[str], target: str) -> Analysis:
+    breaches_raw = next((r.data for r in results if r.collector == "breach_index" and r.has_data), [])
+    signals = signals_for(breaches_raw)
+    accounts = _found_accounts(results)
+    subdomains = _subdomains(results)
+    mail = _data(results, "dns_mail_posture")
+    wildcard = bool((_data(results, "dns_wildcard") or {}).get("wildcard"))
+    ports_data = _data(results, "tcp_ports") or {}
+    risky = [entry.get("port") for entry in ports_data.get("open") or [] if entry.get("port") in RISKY_PORTS]
+    infrastructure = _infrastructure(results, report_notes)
+
+    collected = [r.collector for r in results if r.has_data]
+    skipped = [r.collector for r in results if r.skipped]
+    failed = [r.collector for r in results if not r.ok and not r.skipped]
+
+    summary_parts = [
+        f"Collected public data for {target} from {len(collected)} of "
+        f"{len(results)} sources, with no model call."
+    ]
+    if signals["breach_count"]:
+        summary_parts.append(
+            f"{signals['breach_count']} breach records mention the target, "
+            f"{signals['credential_bearing']} of them credential-bearing."
+        )
+    if accounts:
+        summary_parts.append(f"{len(accounts)} public profiles answered.")
+    if subdomains:
+        summary_parts.append(f"{len(subdomains)} hostnames were discovered.")
+    if failed:
+        summary_parts.append(f"Failed sources: {', '.join(failed)}.")
+    if skipped:
+        summary_parts.append(f"Skipped sources: {', '.join(skipped)}.")
+    summary_parts.append("Risk is computed from counts and policy checks, not narrated.")
+
+    risk = apply_floor("low", signals["risk_floor"])
+    if risky or (wildcard and isinstance(mail, dict) and not mail.get("dmarc_present")):
+        risk = apply_floor(risk, "medium")
+
+    return Analysis(
+        summary=" ".join(summary_parts),
+        breaches=[
+            Breach(
+                name=str(row.get("name")),
+                date=row.get("date"),
+                data_types=list(row.get("data_types") or []),
+                source=row.get("source"),
+            )
+            for row in breaches_raw[:15]
+        ],
+        associated_accounts=accounts,
+        infrastructure_notes=infrastructure,
+        subdomains=subdomains,
+        risk_level=risk,
+        recommendations=_recommendations(
+            signals["credential_bearing"],
+            mail if isinstance(mail, dict) else None,
+            wildcard,
+            risky,
+            signals["breach_count"],
+        ),
+    )

{osintkit-0.1.1 → osintkit-0.2.0}/src/osintkit/pipeline.py

@@ -14,7 +14,7 @@ from pathlib import Path
 
 from rich.console import Console
 
-from . import collectors, normalise, render, retention, synthesis
+from . import collectors, normalise, offline, render, retention, synthesis
 from .config import Settings
 from .errors import MissingAPIKey, OsintKitError, SynthesisError, TargetParseError
 from .http import HttpClient
@@ -182,6 +182,20 @@ async def execute(
             logger.event("run_end", raw=True, report_path=str(archived) if archived else None)
             return Outcome(report=report, extra={"bundle": bundle}, archived=archived)
 
+        if settings.offline:
+            report.model = None
+            report.analysis = offline.build(prompt_results, report.notes, target)
+            report.notes.append("offline mode: risk computed locally, no model call")
+            report.elapsed_ms = int((time.perf_counter() - started) * 1000)
+            archived = archive_report(report.model_dump(mode="json"))
+            logger.event(
+                "run_end",
+                offline=True,
+                report_path=str(archived) if archived else None,
+                risk_level=report.analysis.risk_level,
+            )
+            return Outcome(report=report, archived=archived)
+
         if settings.dry_run:
             report.notes.append("dry run: model not called")
             report.elapsed_ms = int((time.perf_counter() - started) * 1000)

{osintkit-0.1.1 → osintkit-0.2.0}/tests/test_cli.py

@@ -447,3 +447,28 @@ def test_collectors_json():
 
 def fake_name():
     return "fake_source"
+
+
+def test_offline_mode_needs_no_key(monkeypatch):
+    monkeypatch.delenv("API_KEY")
+    monkeypatch.setattr(pipeline, "LLMClient", None)
+    result = runner.invoke(app, ["lookup", "--domain", "example.com", "--offline"])
+    assert result.exit_code == 0
+    assert "no model call" in result.output
+
+
+def test_offline_json_is_a_normal_report(monkeypatch):
+    monkeypatch.delenv("API_KEY")
+    result = runner.invoke(app, ["lookup", "--domain", "example.com", "--offline", "--json"])
+    payload = jsonish(result.output)
+    assert payload["analysis"]["risk_level"] == "low"
+    assert payload["target"] == "example.com"
+
+
+def test_offline_batch(monkeypatch, tmp_path):
+    monkeypatch.delenv("API_KEY")
+    csv_file = tmp_path / "t.csv"
+    csv_file.write_text("a.com\n")
+    result = runner.invoke(app, ["batch", "--file", str(csv_file), "--offline", "--json"])
+    assert result.exit_code == 0
+    assert jsonish(result.output)[0]["analysis"]["risk_level"] == "low"

{osintkit-0.1.1 → osintkit-0.2.0}/tests/test_collectors.py

@@ -477,3 +477,10 @@ async def test_ports_override_limits_the_scan(make_context, monkeypatch):
 def test_selected_ports_keeps_order_and_marks_unknown():
     assert ports.selected_ports(["443", "9999"]) == {443: "https", 9999: "unknown"}
     assert ports.selected_ports(None)[22] == "ssh"
+
+
+def test_every_registered_collector_is_coroutine():
+    import inspect
+
+    for spec in base.REGISTRY:
+        assert inspect.iscoroutinefunction(spec.func), f"{spec.name} is not async"

osintkit-0.2.0/tests/test_offline.py

@@ -0,0 +1,99 @@
+from osintkit import offline
+from osintkit.models import CollectorResult
+
+
+def result(name, data, **kwargs):
+    return CollectorResult(collector=name, target="example.com", target_type="domain", data=data, **kwargs)
+
+
+def test_breaches_drive_risk_and_rotation():
+    results = [
+        result("breach_index", [{"name": "Acme", "data_types": ["Passwords"], "source": "x"}]),
+        result("breach_index", []),
+    ]
+    analysis = offline.build(results, [], "a@b.co")
+    assert analysis.risk_level == "medium"
+    assert analysis.breaches[0].name == "Acme"
+    assert "Rotate" in analysis.recommendations[0]
+
+
+def test_missing_dmarc_is_recommended():
+    results = [result("dns_mail_posture", {"spf_present": True, "spf_all": "-all", "dmarc_present": False})]
+    analysis = offline.build(results, [], "example.com")
+    assert any("DMARC" in note for note in analysis.infrastructure_notes)
+    assert any("DMARC" in rec for rec in analysis.recommendations)
+
+
+def test_loose_spf_is_recommended():
+    results = [
+        result(
+            "dns_mail_posture",
+            {"spf_present": True, "spf_all": "~all", "dmarc_present": True, "dmarc_policy": "reject"},
+        )
+    ]
+    analysis = offline.build(results, [], "example.com")
+    assert any("-all" in rec for rec in analysis.recommendations)
+
+
+def test_risky_port_raises_risk_and_is_noted():
+    results = [result("tcp_ports", {"open": [{"port": 6379, "service": "redis"}]})]
+    analysis = offline.build(results, [], "example.com")
+    assert analysis.risk_level == "medium"
+    assert any("6379" in note for note in analysis.infrastructure_notes)
+    assert any("firewall" in rec for rec in analysis.recommendations)
+
+
+def test_accounts_come_from_presence_and_profile():
+    results = [
+        result(
+            "username_presence",
+            {"handle": "alice", "found": [{"site": "GitHub", "url": "https://github.com/alice"}]},
+        ),
+        result("github_profile", {"profile": {"login": "alice", "url": "https://github.com/alice"}}),
+    ]
+    analysis = offline.build(results, [], "alice")
+    assert [account.platform for account in analysis.associated_accounts] == ["GitHub", "GitHub"]
+    assert "unconfirmed" in analysis.associated_accounts[0].note
+
+
+def test_subdomains_are_deduped_and_capped():
+    hosts = [{"host": f"h{index}.example.com"} for index in range(40)]
+    results = [
+        result("passive_subdomains", {"live_hosts": hosts}),
+        result("crt_sh_subdomains", ["h0.example.com"]),
+    ]
+    analysis = offline.build(results, [], "example.com")
+    assert len(analysis.subdomains) == offline.MAX_SUBDOMAINS
+    assert analysis.subdomains[0] == "h0.example.com"
+
+
+def test_wildcard_without_dmarc_is_medium():
+    results = [
+        result("dns_wildcard", {"wildcard": True}),
+        result(
+            "dns_mail_posture",
+            {"dmarc_present": True, "spf_present": True, "spf_all": "-all", "dmarc_policy": "reject"},
+        ),
+    ]
+    analysis = offline.build(results, [], "example.com")
+    assert any("Wildcard" in note for note in analysis.infrastructure_notes)
+    assert any("wildcard" in rec for rec in analysis.recommendations)
+
+
+def test_gaps_are_reported_in_summary():
+    results = [
+        CollectorResult(collector="hibp_breaches", target="t", target_type="email", ok=False, skipped=True),
+        CollectorResult(collector="dns_records", target="t", target_type="email", ok=False, error="boom"),
+        result("dns_records", {"A": ["1.2.3.4"]}),
+    ]
+    analysis = offline.build(results, ["carried note"], "t")
+    assert "Failed sources: dns_records" in analysis.summary
+    assert "Skipped sources: hibp_breaches" in analysis.summary
+    assert "carried note" in analysis.infrastructure_notes
+
+
+def test_empty_collection_still_yields_a_report():
+    analysis = offline.build([], [], "example.com")
+    assert analysis.risk_level == "low"
+    assert analysis.breaches == []
+    assert analysis.recommendations

{osintkit-0.1.1 → osintkit-0.2.0}/tests/test_pipeline.py

@@ -185,3 +185,12 @@ async def test_no_breaches_keep_the_model_choice(settings, monkeypatch, console)
     monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
     outcome = await pipeline.execute("a@b.co", settings, RunLogger("floor2"), console)
     assert outcome.report.analysis.risk_level == "low"
+
+
+async def test_offline_builds_analysis_without_model(settings, fake_collector, monkeypatch, console):
+    monkeypatch.setattr(pipeline, "LLMClient", None)
+    settings.offline = True
+    outcome = await pipeline.execute("example.com", settings, RunLogger("off"), console)
+    assert outcome.report.analysis is not None
+    assert outcome.report.model is None
+    assert any("offline" in note for note in outcome.report.notes)

{osintkit-0.1.1 → osintkit-0.2.0}/src/osintkit/collectors/ports.py

@@ -59,7 +59,6 @@ async def _probe(host: str, port: int, service: str, semaphore: asyncio.Semaphor
         return {"port": port, "service": service, "banner": banner or None}
 
 
-@collector("tcp_ports", ("domain",), "Open TCP ports on common services", order=80, ttl=3600)
 def selected_ports(override: list[str] | None) -> dict[int, str]:
     if not override:
         return dict(PORTS)
@@ -70,6 +69,7 @@ def selected_ports(override: list[str] | None) -> dict[int, str]:
     return dict(sorted(chosen.items()))
 
 
+@collector("tcp_ports", ("domain",), "Open TCP ports on common services", order=80, ttl=3600)
 async def tcp_ports(ctx: Context) -> dict:
     ports = selected_ports(ctx.settings.extra.get("ports"))
     host = ctx.target.lower()