osintkit 0.2.0__tar.gz → 0.4.0__tar.gz

{osintkit-0.2.0 → osintkit-0.4.0}/CHANGELOG.md

@@ -6,6 +6,27 @@ All notable changes are recorded here. The format follows
 
 ## Unreleased
 
+## 0.4.0 — 2026-11-02
+
+### Added
+
+- `osintkit init` stores a provider and key once, verifies them, and needs no flags afterwards
+- `osintkit config` shows values masked, reveals the key, unsets keys, and prints the path
+- stored config participates in provider/key precedence below flags and environment
+- `doctor` reports whether a config file exists
+
+## 0.3.0 — 2026-11-02
+
+### Added
+
+- providers for DeepSeek, Mistral, Groq, Together, Anthropic, and local Ollama
+- provider selection from its own environment variable (`DEEPSEEK_API_KEY`, `MISTRAL_API_KEY`, ...)
+- keyless providers (Ollama) work without any key, including in `doctor`
+
+### Changed
+
+- `doctor` reports the provider and where the key came from
+
 ## 0.2.0 — 2026-11-02
 
 ### Added

{osintkit-0.2.0 → osintkit-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: osintkit
-Version: 0.2.0
+Version: 0.4.0
 Summary: Public-data OSINT aggregator for emails, usernames, domains, and companies
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/osintkit
 Project-URL: Issues, https://github.com/sjdsjadjajdjsa/osintkit/issues
@@ -74,17 +74,24 @@ checksums, and `pip install -e .` works from a clone. Python 3.12+ only.
 ## Quick start
 
 ```bash
-export API_KEY=...                 # model key, any OpenAI-compatible endpoint
-osintkit doctor --deep             # prove the key and endpoint work
+osintkit init                      # pick a provider, paste a key once
 osintkit lookup alice@example.com
 ```
 
+`init` stores the provider and key in `~/.config/osintkit/config.toml` (mode 600), checks them
+with a one-token request, and afterwards needs no flags and no exports. `osintkit config` shows
+what is stored, masked; `osintkit lookup` just works.
+
+Environment variables still win over the file, so `DEEPSEEK_API_KEY=... osintkit lookup ...`
+overrides the stored provider for one run.
+
 No key? `osintkit lookup example.com --offline` builds the whole report locally from rule checks,
 no model involved. `--raw` gives the collected JSON and `--dry-run` prints the prompt a model
 would receive.
 
-Any OpenAI-compatible endpoint works. `--provider venice|openrouter|openai` picks a preset, and
-a recognisable key prefix picks one for you; `--base-url` and `--model` always win.
+Any OpenAI-compatible endpoint works. `init --provider ollama` needs no key for a local server;
+`--provider`, `--base-url`, and `--model` cover everything else. The preset table, key variables,
+and precedence order are in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
 
 Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts GitHub from 60 to
 5000 requests/hour. Everything else needs no credentials.

{osintkit-0.2.0 → osintkit-0.4.0}/README.md

@@ -42,17 +42,24 @@ checksums, and `pip install -e .` works from a clone. Python 3.12+ only.
 ## Quick start
 
 ```bash
-export API_KEY=...                 # model key, any OpenAI-compatible endpoint
-osintkit doctor --deep             # prove the key and endpoint work
+osintkit init                      # pick a provider, paste a key once
 osintkit lookup alice@example.com
 ```
 
+`init` stores the provider and key in `~/.config/osintkit/config.toml` (mode 600), checks them
+with a one-token request, and afterwards needs no flags and no exports. `osintkit config` shows
+what is stored, masked; `osintkit lookup` just works.
+
+Environment variables still win over the file, so `DEEPSEEK_API_KEY=... osintkit lookup ...`
+overrides the stored provider for one run.
+
 No key? `osintkit lookup example.com --offline` builds the whole report locally from rule checks,
 no model involved. `--raw` gives the collected JSON and `--dry-run` prints the prompt a model
 would receive.
 
-Any OpenAI-compatible endpoint works. `--provider venice|openrouter|openai` picks a preset, and
-a recognisable key prefix picks one for you; `--base-url` and `--model` always win.
+Any OpenAI-compatible endpoint works. `init --provider ollama` needs no key for a local server;
+`--provider`, `--base-url`, and `--model` cover everything else. The preset table, key variables,
+and precedence order are in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
 
 Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts GitHub from 60 to
 5000 requests/hour. Everything else needs no credentials.

{osintkit-0.2.0 → osintkit-0.4.0}/docs/REFERENCE.md

@@ -34,11 +34,20 @@ osintkit --provider openrouter ...
 osintkit --base-url https://gateway.internal/v1 --model house-model ...
 ```
 
-| `--provider` | Endpoint | Default model | Auto-selected by |
+| `--provider` | Endpoint | Default model | Key variable |
 | --- | --- | --- | --- |
-| `venice` (default) | `api.venice.ai/api/v1` | `deepseek-v4-1-flash` | anything else |
-| `openrouter` | `openrouter.ai/api/v1` | `deepseek/deepseek-v4.1-flash-1017` | `sk-or-` key |
-| `openai` | `api.openai.com/v1` | `gpt-4.1-mini` | `sk-proj-` key |
+| `venice` (default) | `api.venice.ai/api/v1` | `deepseek-v4-1-flash` | `API_KEY`, `VENICE_API_KEY` |
+| `openrouter` | `openrouter.ai/api/v1` | `deepseek/deepseek-v4.1-flash-1017` | `OPENROUTER_API_KEY`, `sk-or-` keys |
+| `openai` | `api.openai.com/v1` | `gpt-4.1-mini` | `OPENAI_API_KEY`, `sk-proj-` keys |
+| `deepseek` | `api.deepseek.com/v1` | `deepseek-chat` | `DEEPSEEK_API_KEY` |
+| `mistral` | `api.mistral.ai/v1` | `mistral-small-latest` | `MISTRAL_API_KEY` |
+| `groq` | `api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | `GROQ_API_KEY`, `gsk_` keys |
+| `together` | `api.together.xyz/v1` | Llama 3.3 70B | `TOGETHER_API_KEY` |
+| `anthropic` | `api.anthropic.com/v1` | `claude-sonnet-4-5` | `ANTHROPIC_API_KEY`, `sk-ant-` keys |
+| `ollama` | `localhost:11434/v1` | `llama3.2` | none |
+
+Set a provider-specific variable and that provider is chosen; `API_KEY` alone falls back to the
+default. Recognisable key prefixes override that inference. `--provider` beats both.
 
 Explicit `--base-url` and `--model` beat both the provider and the prefix. Temperature is 0.3,
 `--max-tokens` defaults to 2400.
@@ -52,6 +61,19 @@ Explicit `--base-url` and `--model` beat both the provider and the prefix. Tempe
 Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--offline`, `--dry-run`, `--only`, `--skip`,
 `--ports`, `--fail-fast`, `-c/--concurrency`, `--limit`, `--show`, `--days`, `--clear`, `--deep`.
 
+## Configuration file
+
+`osintkit init` writes `~/.config/osintkit/config.toml` (or `$XDG_CONFIG_HOME`) with mode 600 in
+a 700 directory, after checking the key with a one-token request. Keys recognised:
+`provider`, `model`, `base_url`, `api_key`, `resolvers`.
+
+`osintkit config` prints them masked, `--reveal` shows the key, `--unset KEY` removes one, and
+`--path` prints the location. Deleting the file is the same as `--unset` everything.
+
+Precedence for each value: command-line flag, then the provider-specific environment variable,
+then a key prefix, then the config file, then the built-in default. Stored values apply only when
+the stored provider matches the one in use, so a one-off key export never gets the stored key.
+
 ## Offline mode
 
 `--offline` skips the model: breaches, accounts, hosts, and policy gaps are rendered from the

{osintkit-0.2.0 → osintkit-0.4.0}/examples/README.md

@@ -43,3 +43,10 @@ No key at all:
 osintkit lookup --domain example.com --offline
 osintkit batch --file targets.csv --offline --json
 ```
+
+Set a key once and forget flags:
+
+```bash
+osintkit init
+osintkit lookup --domain example.com
+```

{osintkit-0.2.0 → osintkit-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "osintkit"
-version = "0.2.0"
+version = "0.4.0"
 description = "Public-data OSINT aggregator for emails, usernames, domains, and companies"
 readme = "README.md"
 requires-python = ">=3.12"

{osintkit-0.2.0 → osintkit-0.4.0}/src/osintkit/__init__.py

@@ -1,3 +1,3 @@
 """osintkit: a public-data OSINT aggregator."""
 
-__version__ = "0.2.0"
+__version__ = "0.4.0"

{osintkit-0.2.0 → osintkit-0.4.0}/src/osintkit/cli.py

@@ -18,13 +18,18 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.table import Table
 
-from . import __version__, diff, doctor, pipeline, render, retention
+from . import __version__, diff, doctor, pipeline, render, retention, userconfig
 from .collectors import REGISTRY
 from .config import (
+    DEFAULT_RESOLVERS,
+    GENERIC_KEY_ENVS,
+    KEYLESS_PROVIDERS,
     PROVIDERS,
     Settings,
     cache_clear,
     cache_stats,
+    env_key_for,
+    provider_from_env,
     provider_from_key,
 )
 from .errors import OsintKitError, TargetParseError
@@ -32,7 +37,7 @@ from .logging_store import RunLogger, find_report_for_run, read_report, read_run
 from .targets import VALID_TYPES
 
 app = typer.Typer(
-    add_completion=False,
+    add_completion=True,
     no_args_is_help=True,
     help="Public-data OSINT aggregator for emails, usernames, domains, and companies.",
     rich_markup_mode="rich",
@@ -61,7 +66,7 @@ def _version_callback(value: bool) -> None:
 @app.callback()
 def root(
     provider: str | None = typer.Option(
-        None, "--provider", help="Endpoint preset: venice, openrouter, or openai."
+        None, "--provider", help="Endpoint preset; see docs/REFERENCE.md#providers."
     ),
     base_url: str | None = typer.Option(
         None, "--base-url", help="OpenAI-compatible base URL (overrides the provider)."
@@ -88,12 +93,24 @@ def root(
 ) -> None:
     if provider and provider not in PROVIDERS:
         raise typer.BadParameter(f"unknown provider {provider!r}; choose from {', '.join(PROVIDERS)}")
-    effective_key = api_key or os.environ.get("API_KEY") or os.environ.get("OPENAI_API_KEY")
-    chosen = provider or provider_from_key(effective_key) or "venice"
+    stored = userconfig.load()
+    generic_env = next((os.environ[name] for name in GENERIC_KEY_ENVS if os.environ.get(name)), None)
+    chosen = (
+        provider
+        or provider_from_key(api_key)
+        or provider_from_env()
+        or provider_from_key(generic_env)
+        or stored.get("provider")
+        or "venice"
+    )
     preset = PROVIDERS[chosen]
+    if not api_key and stored.get("provider") in (None, chosen):
+        api_key = stored.get("api_key")
+    config_applies = stored.get("provider") in (None, chosen)
     settings = Settings(
-        base_url=base_url or preset[0],
-        model=model or preset[1],
+        provider=chosen,
+        base_url=base_url or (stored.get("base_url") if config_applies else None) or preset[0],
+        model=model or (stored.get("model") if config_applies else None) or preset[1],
         api_key=api_key,
         temperature=temperature,
         max_tokens=max_tokens,
@@ -103,6 +120,7 @@ def root(
         use_cache=not no_cache,
         cache_ttl=cache_ttl,
         verbose=verbose,
+        resolvers=stored.get("resolvers") or list(DEFAULT_RESOLVERS),
     )
     if resolver:
         for entry in resolver:
@@ -538,6 +556,110 @@ def list_collectors(
     render.console().print(table)
 
 
+@app.command()
+def init(
+    provider: str | None = typer.Option(None, "--provider", help="Provider to store."),
+    api_key: str | None = typer.Option(None, "--api-key", help="Key to store."),
+    model: str | None = typer.Option(None, "--model", help="Default model to store."),
+    base_url: str | None = typer.Option(None, "--base-url", help="Custom endpoint to store."),
+    force: bool = typer.Option(False, "--force", help="Replace an existing config."),
+    verify: bool = typer.Option(True, "--verify/--no-verify", help="Check the key afterwards."),
+) -> None:
+    """Store a provider and key once, then just run lookups."""
+    out = _console()
+    path = userconfig.config_path()
+    if path.exists() and not force:
+        out.print(f"[yellow]config already exists[/yellow] {path}; pass --force to replace")
+        raise typer.Exit(1)
+
+    stored = userconfig.load()
+    detected = (
+        provider
+        or provider_from_env()
+        or provider_from_key(os.environ.get("API_KEY"))
+        or stored.get("provider")
+        or "venice"
+    )
+    chosen = provider or typer.prompt("Provider", default=detected).strip()
+    if chosen not in PROVIDERS:
+        out.print(f"[red]unknown provider {chosen!r}[/red]; choose from {', '.join(PROVIDERS)}")
+        raise typer.Exit(2)
+
+    data: dict[str, object] = {"provider": chosen}
+    if base_url:
+        data["base_url"] = base_url
+    if model:
+        data["model"] = model
+
+    if chosen not in KEYLESS_PROVIDERS:
+        key = (
+            api_key
+            or env_key_for(chosen)
+            or (stored.get("api_key") if stored.get("provider") == chosen else None)
+            or typer.prompt("API key", hide_input=True).strip()
+        )
+        if not key:
+            out.print("[red]no key given[/red]")
+            raise typer.Exit(2)
+        data["api_key"] = key
+
+    written = userconfig.save(data)
+    out.print(f"[green]stored[/green] {written} (mode 600)")
+    out.print(f"provider: {chosen}")
+    if data.get("api_key"):
+        out.print(f"key: {userconfig.mask(str(data['api_key']))}")
+
+    if verify:
+        probe = Settings(
+            provider=chosen,
+            base_url=str(data.get("base_url") or PROVIDERS[chosen][0]),
+            model=str(data.get("model") or PROVIDERS[chosen][1]),
+            api_key=str(data["api_key"]) if data.get("api_key") else None,
+            use_cache=False,
+        )
+        checks = asyncio.run(doctor.diagnose(probe, deep=True))
+        endpoint = checks[-1]
+        if doctor.failed(checks):
+            out.print(f"[red]{endpoint.detail}[/red]")
+            out.print("[dim]config kept; fix it with osintkit init --force[/dim]")
+            raise typer.Exit(1)
+        out.print(f"[green]{endpoint.detail}[/green]")
+    out.print("[dim]try: osintkit lookup --domain example.com[/dim]")
+
+
+@app.command("config")
+def config_cmd(
+    reveal: bool = typer.Option(False, "--reveal", help="Show the key in full."),
+    unset: list[str] | None = typer.Option(None, "--unset", help="Remove a key."),
+    path_only: bool = typer.Option(False, "--path", help="Print the config path only."),
+) -> None:
+    """Show, reveal, or clear the stored configuration."""
+    out = _console()
+    if path_only:
+        print(userconfig.config_path())
+        return
+    stored = userconfig.load()
+    if unset:
+        for name in unset:
+            stored.pop(name, None)
+        userconfig.save(stored)
+        out.print(f"[green]removed[/green] {', '.join(unset)}")
+        stored = userconfig.load()
+    if not stored:
+        out.print(f"[dim]no config at {userconfig.config_path()}[/dim]")
+        return
+    out.print(f"[dim]{userconfig.config_path()}[/dim]")
+    table = Table(box=box.SIMPLE_HEAD, title="config")
+    table.add_column("key")
+    table.add_column("value")
+    for name, value in stored.items():
+        shown: object = value
+        if name == "api_key" and isinstance(value, str) and not reveal:
+            shown = userconfig.mask(value)
+        table.add_row(name, render.escape(str(shown)))
+    out.print(table)
+
+
 @app.command("doctor")
 def doctor_cmd(
     json_out: bool = typer.Option(False, "--json", help="JSON output."),

{osintkit-0.2.0 → osintkit-0.4.0}/src/osintkit/config.py

@@ -23,8 +23,31 @@ PROVIDERS: dict[str, tuple[str, str]] = {
     "venice": (DEFAULT_BASE_URL, DEFAULT_MODEL),
     "openrouter": ("https://openrouter.ai/api/v1", "deepseek/deepseek-v4.1-flash-1017"),
     "openai": ("https://api.openai.com/v1", "gpt-4.1-mini"),
+    "deepseek": ("https://api.deepseek.com/v1", "deepseek-chat"),
+    "mistral": ("https://api.mistral.ai/v1", "mistral-small-latest"),
+    "groq": ("https://api.groq.com/openai/v1", "llama-3.3-70b-versatile"),
+    "together": ("https://api.together.xyz/v1", "meta-llama/Llama-3.3-70B-Instruct-Turbo"),
+    "anthropic": ("https://api.anthropic.com/v1", "claude-sonnet-4-5"),
+    "ollama": ("http://localhost:11434/v1", "llama3.2"),
 }
-KEY_PREFIXES: dict[str, str] = {"sk-or-": "openrouter", "sk-proj-": "openai"}
+KEYLESS_PROVIDERS = frozenset({"ollama"})
+KEY_PREFIXES: dict[str, str] = {
+    "sk-or-": "openrouter",
+    "sk-proj-": "openai",
+    "gsk_": "groq",
+    "sk-ant-": "anthropic",
+}
+PROVIDER_ENV: dict[str, str] = {
+    "VENICE_API_KEY": "venice",
+    "OPENROUTER_API_KEY": "openrouter",
+    "OPENAI_API_KEY": "openai",
+    "DEEPSEEK_API_KEY": "deepseek",
+    "MISTRAL_API_KEY": "mistral",
+    "GROQ_API_KEY": "groq",
+    "TOGETHER_API_KEY": "together",
+    "ANTHROPIC_API_KEY": "anthropic",
+}
+GENERIC_KEY_ENVS = ("API_KEY",)
 
 
 def provider_from_key(api_key: str | None) -> str | None:
@@ -37,6 +60,21 @@ def provider_from_key(api_key: str | None) -> str | None:
     return None
 
 
+def env_key_for(provider: str) -> str | None:
+    for variable, name in PROVIDER_ENV.items():
+        if name == provider and os.environ.get(variable):
+            return os.environ[variable]
+    return None
+
+
+def provider_from_env() -> str | None:
+    """Infer a provider from whichever provider-specific variable is set."""
+    for variable, provider in PROVIDER_ENV.items():
+        if os.environ.get(variable):
+            return provider
+    return None
+
+
 def app_home() -> Path:
     override = os.environ.get(APP_HOME_ENV)
     if override:
@@ -67,6 +105,7 @@ class Settings:
 
     target: str = ""
     target_type: str = ""
+    provider: str = "venice"
     base_url: str = DEFAULT_BASE_URL
     model: str = DEFAULT_MODEL
     api_key: str | None = None
@@ -95,7 +134,19 @@ class Settings:
         return os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN") or None
 
     def resolved_api_key(self) -> str | None:
-        return self.api_key or os.environ.get("API_KEY") or os.environ.get("OPENAI_API_KEY")
+        if self.api_key:
+            return self.api_key
+        for variable, provider in PROVIDER_ENV.items():
+            if provider == self.provider and os.environ.get(variable):
+                return os.environ[variable]
+        for variable in GENERIC_KEY_ENVS:
+            if os.environ.get(variable):
+                return os.environ[variable]
+        return None
+
+    @property
+    def needs_key(self) -> bool:
+        return self.provider not in KEYLESS_PROVIDERS
 
 
 def _cache_key(namespace: str, key: str) -> Path:

{osintkit-0.2.0 → osintkit-0.4.0}/src/osintkit/doctor.py

@@ -7,7 +7,8 @@ import tempfile
 from dataclasses import dataclass, replace
 from pathlib import Path
 
-from .config import Settings, cache_dir, ensure_dirs, log_dir
+from . import userconfig
+from .config import PROVIDER_ENV, Settings, cache_dir, ensure_dirs, log_dir
 from .http import HttpClient
 
 
@@ -30,10 +31,10 @@ def _writable(path: Path) -> bool:
 
 async def _reach_endpoint(settings: Settings, deep: bool = False) -> Check:
     key = settings.resolved_api_key()
-    if not key:
+    if settings.needs_key and not key:
         return Check("model endpoint", "warn", "no API key; synthesis will fail, dry runs still work")
     base = settings.base_url.rstrip("/")
-    headers = {"Authorization": f"Bearer {key}"}
+    headers = {"Authorization": f"Bearer {key}"} if key else {}
     fresh = replace(settings, use_cache=False)
 
     try:
@@ -81,14 +82,36 @@ async def _reach_endpoint(settings: Settings, deep: bool = False) -> Check:
     return Check("model endpoint", "ok", f"{base} accepted a completion for {settings.model}")
 
 
+def _key_source(settings: Settings) -> str | None:
+    if settings.api_key:
+        return "--api-key"
+    for variable, provider in PROVIDER_ENV.items():
+        if provider == settings.provider and os.environ.get(variable):
+            return variable
+    for variable in ("API_KEY",):
+        if os.environ.get(variable):
+            return variable
+    return None
+
+
 def collect_checks(settings: Settings) -> list[Check]:
     key = settings.resolved_api_key()
+    source = _key_source(settings)
+    if not settings.needs_key:
+        key_check = Check("api key", "ok", f"not needed for {settings.provider}")
+    elif key:
+        key_check = Check("api key", "ok", f"from {source}")
+    else:
+        key_check = Check("api key", "warn", f"no key for {settings.provider}; set one or use --offline")
+    config = userconfig.config_path()
     checks = [
+        Check("provider", "ok", settings.provider),
         Check(
-            "api key",
-            "ok" if key else "warn",
-            "set" if key else "API_KEY is not set",
+            "config file",
+            "ok" if config.exists() else "warn",
+            str(config) if config.exists() else f"none at {config}; run osintkit init",
         ),
+        key_check,
         Check(
             "cache dir",
             "ok" if _writable(cache_dir()) else "fail",

{osintkit-0.2.0 → osintkit-0.4.0}/src/osintkit/llm.py

@@ -38,7 +38,7 @@ class LLMClient:
         response_format: Mapping[str, Any] | None = None,
     ) -> str:
         api_key = self.settings.resolved_api_key()
-        if not api_key:
+        if not api_key and self.settings.needs_key:
             raise MissingAPIKey("No API key. Set API_KEY in the environment or pass --api-key.")
 
         payload: dict[str, Any] = {
@@ -57,7 +57,7 @@ class LLMClient:
                 namespace="llm",
                 payload=payload,
                 headers={
-                    "Authorization": f"Bearer {api_key}",
+                    **({"Authorization": f"Bearer {api_key}"} if api_key else {}),
                     "Content-Type": "application/json",
                 },
             )

{osintkit-0.2.0 → osintkit-0.4.0}/src/osintkit/pipeline.py

@@ -212,8 +212,10 @@ async def execute(
             return Outcome(report=report, extra={"prompt": synthesis_prompt}, archived=archived)
 
         try:
-            if not settings.resolved_api_key():
-                raise MissingAPIKey("No API key. Set API_KEY or pass --api-key (dry run works without one).")
+            if settings.needs_key and not settings.resolved_api_key():
+                raise MissingAPIKey(
+                    "No API key. Set API_KEY, pass --api-key, or use --offline for a local report."
+                )
             async with LLMClient(settings, http) as client:
                 with _status(progress, settings, "[cyan]synthesising briefing…[/cyan]"):
                     report.analysis = await synthesis.synthesize(

osintkit-0.4.0/src/osintkit/userconfig.py

@@ -0,0 +1,94 @@
+"""Persistent user configuration at ~/.config/osintkit/config.toml."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+FILENAME = "config.toml"
+KEYS = ("provider", "model", "base_url", "api_key", "resolvers")
+SECRET_KEYS = frozenset({"api_key"})
+
+
+def config_home() -> Path:
+    override = os.environ.get("XDG_CONFIG_HOME")
+    base = Path(override).expanduser() if override else Path.home() / ".config"
+    return base / "osintkit"
+
+
+def config_path() -> Path:
+    return config_home() / FILENAME
+
+
+def _parse(text: str) -> dict[str, Any]:
+    import tomllib
+
+    try:
+        data = tomllib.loads(text)
+    except (tomllib.TOMLDecodeError, ValueError):
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    return data
+
+
+def load() -> dict[str, Any]:
+    try:
+        raw = config_path().read_text("utf-8")
+    except OSError:
+        return {}
+    data = _parse(raw)
+    out: dict[str, Any] = {}
+    for key in KEYS:
+        value = data.get(key)
+        if isinstance(value, str) and value:
+            out[key] = value
+        elif key == "resolvers" and isinstance(value, list):
+            out[key] = [str(item) for item in value if item]
+    return out
+
+
+def _quote(value: str) -> str:
+    return '"' + value.replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+
+def render(data: dict[str, Any]) -> str:
+    lines = ["# osintkit configuration", ""]
+    for key in KEYS:
+        value = data.get(key)
+        if not value:
+            continue
+        if isinstance(value, list):
+            rendered = ", ".join(_quote(item) for item in value)
+            lines.append(f"{key} = [{rendered}]")
+        else:
+            lines.append(f"{key} = {_quote(str(value))}")
+    return "\n".join(lines) + "\n"
+
+
+def save(data: dict[str, Any]) -> Path:
+    home = config_home()
+    home.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(home, 0o700)
+    except OSError:
+        pass
+    path = config_path()
+    tmp = path.with_suffix(".tmp")
+    tmp.write_text(render(data), "utf-8")
+    os.chmod(tmp, 0o600)
+    tmp.replace(path)
+    return path
+
+
+def mask(secret: str) -> str:
+    if len(secret) <= 8:
+        return "*" * len(secret)
+    return f"{secret[:6]}…{secret[-4:]}"
+
+
+def as_settings(data: dict[str, Any]) -> dict[str, Any]:
+    """Map config keys onto Settings field names."""
+    mapping = {"base_url": "base_url", "model": "model", "resolvers": "resolvers"}
+    return {target: data[source] for source, target in mapping.items() if data.get(source)}

{osintkit-0.2.0 → osintkit-0.4.0}/tests/conftest.py

@@ -12,6 +12,7 @@ from osintkit.http import HttpClient
 def isolated_home(tmp_path: Path, monkeypatch):
     home = tmp_path / "home"
     monkeypatch.setenv("OSINTKIT_HOME", str(home))
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(home / "config"))
     monkeypatch.delenv("API_KEY", raising=False)
     monkeypatch.delenv("OPENAI_API_KEY", raising=False)
     monkeypatch.delenv("HIBP_API_KEY", raising=False)

{osintkit-0.2.0 → osintkit-0.4.0}/tests/test_cli.py

@@ -472,3 +472,149 @@ def test_offline_batch(monkeypatch, tmp_path):
     result = runner.invoke(app, ["batch", "--file", str(csv_file), "--offline", "--json"])
     assert result.exit_code == 0
     assert jsonish(result.output)[0]["analysis"]["risk_level"] == "low"
+
+
+def test_missing_key_mentions_offline(monkeypatch):
+    monkeypatch.delenv("API_KEY")
+    monkeypatch.setattr(pipeline, "LLMClient", None)
+    result = runner.invoke(app, ["lookup", "--domain", "example.com"])
+    assert "--offline" in " ".join(result.output.split())
+
+
+def test_deepseek_env_selects_provider(monkeypatch):
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "d" * 30)
+    monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
+    result = runner.invoke(app, ["lookup", "--domain", "a.com", "--json"])
+    assert jsonish(result.output)["base_url"] == "https://api.deepseek.com/v1"
+
+
+def test_mistral_env_selects_provider(monkeypatch):
+    monkeypatch.setenv("MISTRAL_API_KEY", "m" * 30)
+    monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
+    result = runner.invoke(app, ["lookup", "--domain", "a.com", "--json"])
+    assert jsonish(result.output)["base_url"] == "https://api.mistral.ai/v1"
+
+
+def test_explicit_provider_beats_env(monkeypatch):
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "d" * 30)
+    monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
+    result = runner.invoke(app, ["--provider", "mistral", "lookup", "--domain", "a.com", "--json"])
+    assert jsonish(result.output)["base_url"] == "https://api.mistral.ai/v1"
+
+
+def test_ollama_needs_no_key(monkeypatch):
+    monkeypatch.delenv("API_KEY")
+    monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
+    result = runner.invoke(app, ["--provider", "ollama", "lookup", "--domain", "a.com", "--json"])
+    assert result.exit_code == 0
+    assert jsonish(result.output)["base_url"] == "http://localhost:11434/v1"
+
+
+@pytest.fixture
+def xdg(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "xdg"))
+
+
+def test_init_writes_config_and_verifies(monkeypatch, xdg):
+    import httpx
+    import respx
+
+    from osintkit import userconfig
+
+    with respx.mock:
+        respx.get("https://api.deepseek.com/v1/models").mock(return_value=httpx.Response(200, json={}))
+        respx.post("https://api.deepseek.com/v1/chat/completions").mock(
+            return_value=httpx.Response(200, json={"choices": [{"message": {"content": "p"}}]})
+        )
+        result = runner.invoke(app, ["init", "--provider", "deepseek", "--api-key", "sk-" + "d" * 30])
+    assert result.exit_code == 0
+    stored = userconfig.load()
+    assert stored["provider"] == "deepseek"
+    assert "try: osintkit lookup" in result.output
+
+
+def test_init_refuses_existing_without_force(xdg):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice"})
+    result = runner.invoke(app, ["init", "--api-key", "k" * 30, "--no-verify"])
+    assert result.exit_code == 1
+    assert "already exists" in result.output
+
+
+def test_init_force_replaces(xdg):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "api_key": "old"})
+    result = runner.invoke(
+        app, ["init", "--provider", "mistral", "--api-key", "m" * 30, "--force", "--no-verify"]
+    )
+    assert result.exit_code == 0
+    assert userconfig.load()["provider"] == "mistral"
+
+
+def test_init_unknown_provider(xdg):
+    result = runner.invoke(app, ["init", "--provider", "nope", "--api-key", "k", "--no-verify"])
+    assert result.exit_code == 2
+    assert "unknown provider" in result.output
+
+
+def test_init_ollama_needs_no_key(xdg, monkeypatch):
+    from osintkit import userconfig
+
+    monkeypatch.delenv("API_KEY", raising=False)
+    result = runner.invoke(app, ["init", "--provider", "ollama", "--no-verify"])
+    assert result.exit_code == 0
+    assert "api_key" not in userconfig.load()
+
+
+def test_config_masks_and_reveals(xdg):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "api_key": "sk-venice-abcdef123456"})
+    masked = runner.invoke(app, ["config"])
+    assert "sk-ven…3456" in masked.output
+    assert "abcdef123456" not in masked.output
+    revealed = runner.invoke(app, ["config", "--reveal"])
+    assert "sk-venice-abcdef123456" in revealed.output
+
+
+def test_config_unset_and_path(xdg):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "model": "m"})
+    removed = runner.invoke(app, ["config", "--unset", "model"])
+    assert removed.exit_code == 0
+    assert "model" not in userconfig.load()
+    path = runner.invoke(app, ["config", "--path"])
+    assert str(userconfig.config_path()) in path.output
+
+
+def test_stored_key_is_used(monkeypatch, xdg):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "api_key": "stored-key-123"})
+    monkeypatch.delenv("API_KEY")
+    monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
+    result = runner.invoke(app, ["lookup", "--domain", "a.com", "--json"])
+    assert result.exit_code == 0
+    assert jsonish(result.output)["base_url"] == "https://api.venice.ai/api/v1"
+
+
+def test_env_beats_stored_provider(monkeypatch, xdg):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "api_key": "stored"})
+    monkeypatch.setenv("MISTRAL_API_KEY", "m" * 30)
+    monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
+    result = runner.invoke(app, ["lookup", "--domain", "a.com", "--json"])
+    assert jsonish(result.output)["base_url"] == "https://api.mistral.ai/v1"
+
+
+def test_flag_beats_stored_config(monkeypatch, xdg):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "api_key": "stored", "model": "stored-model"})
+    monkeypatch.setattr(pipeline, "LLMClient", FakeLLM)
+    result = runner.invoke(app, ["--model", "flag-model", "lookup", "--domain", "a.com", "--json"])
+    assert jsonish(result.output)["model"] == "flag-model"

{osintkit-0.2.0 → osintkit-0.4.0}/tests/test_doctor.py

@@ -47,6 +47,19 @@ async def test_no_key_skips_endpoint_call():
     assert "no API key" in checks[-1].detail
 
 
+async def test_keyless_provider_needs_no_key():
+    checks = await doctor.diagnose(Settings(provider="ollama", base_url="http://localhost:1/v1"))
+    key = next(c for c in checks if c.name == "api key")
+    assert key.status == "ok"
+    assert "not needed" in key.detail
+
+
+def test_key_source_names_the_variable(monkeypatch):
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "d" * 25)
+    check = next(c for c in doctor.collect_checks(Settings(provider="deepseek")) if c.name == "api key")
+    assert check.detail == "from DEEPSEEK_API_KEY"
+
+
 @respx.mock
 async def test_deep_probe_accepts_completion():
     respx.get("https://api.test/v1/models").mock(return_value=httpx.Response(200, json={}))
@@ -81,3 +94,11 @@ async def test_shallow_probe_does_not_call_the_model():
     respx.get("https://api.test/v1/models").mock(return_value=httpx.Response(200, json={}))
     checks = await doctor.diagnose(Settings(base_url="https://api.test/v1", api_key="k" * 25))
     assert "not exercised" in checks[-1].detail
+
+
+@respx.mock
+async def test_keyless_provider_probes_without_auth():
+    route = respx.get("http://localhost:1/v1/models").mock(return_value=httpx.Response(200, json={}))
+    checks = await doctor.diagnose(Settings(provider="ollama", base_url="http://localhost:1/v1"))
+    assert checks[-1].status == "ok"
+    assert "authorization" not in route.calls[0].request.headers

{osintkit-0.2.0 → osintkit-0.4.0}/tests/test_llm.py

@@ -96,3 +96,16 @@ async def test_other_errors_stay_source_errors(settings):
     async with client(settings) as llm:
         with pytest.raises(SourceUnavailable):
             await llm.chat([{"role": "user", "content": "x"}])
+
+
+@respx.mock
+async def test_keyless_provider_sends_no_auth_header(settings):
+    settings.provider = "ollama"
+    settings.api_key = None
+    settings.base_url = "http://localhost:1/v1"
+    route = respx.post("http://localhost:1/v1/chat/completions").mock(
+        return_value=httpx.Response(200, json={"choices": [{"message": {"content": "ok"}}]})
+    )
+    async with LLMClient(settings) as llm:
+        assert await llm.chat([{"role": "user", "content": "x"}]) == "ok"
+    assert "authorization" not in route.calls[0].request.headers

osintkit-0.4.0/tests/test_userconfig.py

@@ -0,0 +1,59 @@
+import os
+import stat
+
+import pytest
+
+from osintkit import userconfig
+
+
+@pytest.fixture(autouse=True)
+def xdg(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path / "xdg"))
+
+
+def test_roundtrip_and_permissions():
+    path = userconfig.save({"provider": "deepseek", "api_key": "sk-test-123456"})
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    loaded = userconfig.load()
+    assert loaded["provider"] == "deepseek"
+    assert loaded["api_key"] == "sk-test-123456"
+
+
+def test_render_quotes_specials():
+    text = userconfig.render({"api_key": 'we"ird\\key', "resolvers": ["1.1.1.1"]})
+    assert 'api_key = "we\\"ird\\\\key"' in text
+    assert 'resolvers = ["1.1.1.1"]' in text
+
+
+def test_load_missing_is_empty():
+    assert userconfig.load() == {}
+
+
+def test_load_malformed_is_empty():
+    path = userconfig.config_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text("not toml at all = [", "utf-8")
+    assert userconfig.load() == {}
+
+
+def test_unknown_keys_are_dropped():
+    path = userconfig.config_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text('provider = "x"\nbogus = "y"\n', "utf-8")
+    assert userconfig.load() == {"provider": "x"}
+
+
+def test_mask_short_and_long():
+    assert userconfig.mask("short") == "*****"
+    assert userconfig.mask("sk-or-abcdef123456") == "sk-or-…3456"
+
+
+def test_config_home_follows_xdg(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    assert str(tmp_path) in str(userconfig.config_path())
+
+
+def test_save_creates_private_directory(tmp_path):
+    path = userconfig.save({"provider": "venice"})
+    assert stat.S_IMODE(path.parent.stat().st_mode) == 0o700
+    assert os.access(path, os.R_OK)