osintkit 0.3.0__tar.gz → 0.5.0__tar.gz

{osintkit-0.3.0 → osintkit-0.5.0}/CHANGELOG.md

@@ -6,6 +6,30 @@ All notable changes are recorded here. The format follows
 
 ## Unreleased
 
+## 0.5.0 — 2026-11-02
+
+### Added
+
+- breach rows are enriched with date, exposed fields, domain, and record count from the keyless
+  HIBP and XposedOrNot catalogues
+- `osintkit password` checks Pwned Passwords by SHA-1 prefix; no key, no plaintext sent
+- email lookups also collect the address domain's DNS, mail posture, and WHOIS, marked as derived
+- a failed synthesis now falls back to a locally built report instead of an empty one
+
+### Fixed
+
+- large prompts came back empty on reasoning models: token truncation is detected and retried,
+  and the prompt carries at most 15 breach rows
+
+## 0.4.0 — 2026-11-02
+
+### Added
+
+- `osintkit init` stores a provider and key once, verifies them, and needs no flags afterwards
+- `osintkit config` shows values masked, reveals the key, unsets keys, and prints the path
+- stored config participates in provider/key precedence below flags and environment
+- `doctor` reports whether a config file exists
+
 ## 0.3.0 — 2026-11-02
 
 ### Added

{osintkit-0.3.0 → osintkit-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: osintkit
-Version: 0.3.0
+Version: 0.5.0
 Summary: Public-data OSINT aggregator for emails, usernames, domains, and companies
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/osintkit
 Project-URL: Issues, https://github.com/sjdsjadjajdjsa/osintkit/issues
@@ -74,20 +74,24 @@ checksums, and `pip install -e .` works from a clone. Python 3.12+ only.
 ## Quick start
 
 ```bash
-export API_KEY=...                 # or DEEPSEEK_API_KEY, MISTRAL_API_KEY, ...
-osintkit doctor --deep             # prove the key and endpoint work
+osintkit init                      # pick a provider, paste a key once
 osintkit lookup alice@example.com
 ```
 
+`init` stores the provider and key in `~/.config/osintkit/config.toml` (mode 600), checks them
+with a one-token request, and afterwards needs no flags and no exports. `osintkit config` shows
+what is stored, masked; `osintkit lookup` just works.
+
+Environment variables still win over the file, so `DEEPSEEK_API_KEY=... osintkit lookup ...`
+overrides the stored provider for one run.
+
 No key? `osintkit lookup example.com --offline` builds the whole report locally from rule checks,
 no model involved. `--raw` gives the collected JSON and `--dry-run` prints the prompt a model
 would receive.
 
-Any OpenAI-compatible endpoint works: export the provider's own variable (`DEEPSEEK_API_KEY`,
-`MISTRAL_API_KEY`, `GROQ_API_KEY`, `VENICE_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`,
-`TOGETHER_API_KEY`, `ANTHROPIC_API_KEY`) and that provider is used. `--provider` also accepts
-`ollama` for a local server with no key. `--base-url` and `--model` always win, and the full
-preset table is in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
+Any OpenAI-compatible endpoint works. `init --provider ollama` needs no key for a local server;
+`--provider`, `--base-url`, and `--model` cover everything else. The preset table, key variables,
+and precedence order are in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
 
 Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts GitHub from 60 to
 5000 requests/hour. Everything else needs no credentials.
@@ -99,6 +103,7 @@ Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts G
 | `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`) |
 | `batch` | A CSV of targets, run concurrently, reported in order |
 | `diff` | What changed between two archived runs |
+| `password` | Is a password in Pwned Passwords (free, no key, hash-prefix only) |
 | `history` | Past runs, replayable by id |
 | `doctor` | Key, endpoint, and directory checks (`--deep` verifies auth) |
 | `collectors` | Every collector and what it touches |
@@ -128,8 +133,11 @@ target -> type detection -> collectors (parallel, cached, retried)
 Collectors degrade to a logged gap, never a dead run; a report is produced even when sources or
 the model fail.
 
-- **Merged breaches.** Three indexes listing one incident collapse into one row with every
-  source and the earliest date.
+- **Merged, enriched breaches.** Records collapse into one row per incident, keeping every
+  source and the earliest date, then pick up dates and exposed-field lists from the public HIBP
+  and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
+- **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
+  posture, and WHOIS, marked as derived.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
@@ -144,6 +152,17 @@ connect probes, GitHub (profile, commits, user search, org repos), psbdmp with a
 grep.app, Hacker News, Stack Exchange, and username presence. The full table is in
 [docs/REFERENCE.md](docs/REFERENCE.md#collectors) or via `osintkit collectors`.
 
+## Breach depth
+
+Breach name lists are free; breach *metadata* is what makes them useful. Every row is joined
+against the public HIBP and XposedOrNot catalogues for date, exposed fields, and record count, so
+the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
+`HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
+
+Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
+millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
+machine.
+
 ## Safety and legality
 
 - Public data only. No logins, no scraping behind auth, no paid brokers.

{osintkit-0.3.0 → osintkit-0.5.0}/README.md

@@ -42,20 +42,24 @@ checksums, and `pip install -e .` works from a clone. Python 3.12+ only.
 ## Quick start
 
 ```bash
-export API_KEY=...                 # or DEEPSEEK_API_KEY, MISTRAL_API_KEY, ...
-osintkit doctor --deep             # prove the key and endpoint work
+osintkit init                      # pick a provider, paste a key once
 osintkit lookup alice@example.com
 ```
 
+`init` stores the provider and key in `~/.config/osintkit/config.toml` (mode 600), checks them
+with a one-token request, and afterwards needs no flags and no exports. `osintkit config` shows
+what is stored, masked; `osintkit lookup` just works.
+
+Environment variables still win over the file, so `DEEPSEEK_API_KEY=... osintkit lookup ...`
+overrides the stored provider for one run.
+
 No key? `osintkit lookup example.com --offline` builds the whole report locally from rule checks,
 no model involved. `--raw` gives the collected JSON and `--dry-run` prints the prompt a model
 would receive.
 
-Any OpenAI-compatible endpoint works: export the provider's own variable (`DEEPSEEK_API_KEY`,
-`MISTRAL_API_KEY`, `GROQ_API_KEY`, `VENICE_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`,
-`TOGETHER_API_KEY`, `ANTHROPIC_API_KEY`) and that provider is used. `--provider` also accepts
-`ollama` for a local server with no key. `--base-url` and `--model` always win, and the full
-preset table is in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
+Any OpenAI-compatible endpoint works. `init --provider ollama` needs no key for a local server;
+`--provider`, `--base-url`, and `--model` cover everything else. The preset table, key variables,
+and precedence order are in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
 
 Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts GitHub from 60 to
 5000 requests/hour. Everything else needs no credentials.
@@ -67,6 +71,7 @@ Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts G
 | `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`) |
 | `batch` | A CSV of targets, run concurrently, reported in order |
 | `diff` | What changed between two archived runs |
+| `password` | Is a password in Pwned Passwords (free, no key, hash-prefix only) |
 | `history` | Past runs, replayable by id |
 | `doctor` | Key, endpoint, and directory checks (`--deep` verifies auth) |
 | `collectors` | Every collector and what it touches |
@@ -96,8 +101,11 @@ target -> type detection -> collectors (parallel, cached, retried)
 Collectors degrade to a logged gap, never a dead run; a report is produced even when sources or
 the model fail.
 
-- **Merged breaches.** Three indexes listing one incident collapse into one row with every
-  source and the earliest date.
+- **Merged, enriched breaches.** Records collapse into one row per incident, keeping every
+  source and the earliest date, then pick up dates and exposed-field lists from the public HIBP
+  and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
+- **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
+  posture, and WHOIS, marked as derived.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
@@ -112,6 +120,17 @@ connect probes, GitHub (profile, commits, user search, org repos), psbdmp with a
 grep.app, Hacker News, Stack Exchange, and username presence. The full table is in
 [docs/REFERENCE.md](docs/REFERENCE.md#collectors) or via `osintkit collectors`.
 
+## Breach depth
+
+Breach name lists are free; breach *metadata* is what makes them useful. Every row is joined
+against the public HIBP and XposedOrNot catalogues for date, exposed fields, and record count, so
+the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
+`HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
+
+Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
+millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
+machine.
+
 ## Safety and legality
 
 - Public data only. No logins, no scraping behind auth, no paid brokers.

{osintkit-0.3.0 → osintkit-0.5.0}/docs/REFERENCE.md

@@ -61,6 +61,32 @@ Explicit `--base-url` and `--model` beat both the provider and the prefix. Tempe
 Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--offline`, `--dry-run`, `--only`, `--skip`,
 `--ports`, `--fail-fast`, `-c/--concurrency`, `--limit`, `--show`, `--days`, `--clear`, `--deep`.
 
+## Breach catalogue enrichment
+
+Breach names from free indexes are joined against `haveibeenpwned.com/api/v3/breaches` (keyless
+catalogue) with an XposedOrNot catalogue fallback, cached a week, to add dates, exposed fields,
+domains, and record counts. At most 15 enriched rows go into the prompt; the true count stays in
+`signals`.
+
+## Password checks
+
+`osintkit password [VALUE]` hashes locally, sends only the five-character SHA-1 prefix to
+`api.pwnedpasswords.com`, and reports the count and a commonness rating. Exit code `1` means
+pwned. `--json` for machines. Nothing about the password beyond the prefix leaves the machine.
+
+## Configuration file
+
+`osintkit init` writes `~/.config/osintkit/config.toml` (or `$XDG_CONFIG_HOME`) with mode 600 in
+a 700 directory, after checking the key with a one-token request. Keys recognised:
+`provider`, `model`, `base_url`, `api_key`, `resolvers`.
+
+`osintkit config` prints them masked, `--reveal` shows the key, `--unset KEY` removes one, and
+`--path` prints the location. Deleting the file is the same as `--unset` everything.
+
+Precedence for each value: command-line flag, then the provider-specific environment variable,
+then a key prefix, then the config file, then the built-in default. Stored values apply only when
+the stored provider matches the one in use, so a one-off key export never gets the stored key.
+
 ## Offline mode
 
 `--offline` skips the model: breaches, accounts, hosts, and policy gaps are rendered from the

{osintkit-0.3.0 → osintkit-0.5.0}/examples/README.md

@@ -43,3 +43,10 @@ No key at all:
 osintkit lookup --domain example.com --offline
 osintkit batch --file targets.csv --offline --json
 ```
+
+Set a key once and forget flags:
+
+```bash
+osintkit init
+osintkit lookup --domain example.com
+```

{osintkit-0.3.0 → osintkit-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "osintkit"
-version = "0.3.0"
+version = "0.5.0"
 description = "Public-data OSINT aggregator for emails, usernames, domains, and companies"
 readme = "README.md"
 requires-python = ">=3.12"

{osintkit-0.3.0 → osintkit-0.5.0}/src/osintkit/__init__.py

@@ -1,3 +1,3 @@
 """osintkit: a public-data OSINT aggregator."""
 
-__version__ = "0.3.0"
+__version__ = "0.5.0"

osintkit-0.5.0/src/osintkit/catalogue.py

@@ -0,0 +1,94 @@
+"""Public breach catalogues used to enrich bare breach names."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from .errors import OsintKitError
+from .http import HttpClient, cache_hit, cache_put
+
+NAMESPACE = "catalogue"
+TTL = 7 * 24 * 3600
+KEY_RE = re.compile(r"[^a-z0-9]+")
+
+HIBP = "https://haveibeenpwned.com/api/v3/breaches"
+XPOSED = "https://api.xposedornot.com/v1/breaches"
+
+
+def _key(name: str) -> str:
+    return KEY_RE.sub("", name.lower())
+
+
+def _from_hibp(rows: Any) -> dict[str, dict[str, Any]]:
+    if not isinstance(rows, list):
+        return {}
+    out: dict[str, dict[str, Any]] = {}
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        name = str(row.get("Name") or row.get("Title") or "").strip()
+        if not name:
+            continue
+        out[_key(name)] = {
+            "name": name,
+            "date": row.get("BreachDate"),
+            "data_types": [str(kind) for kind in row.get("DataClasses") or []],
+            "domain": row.get("Domain"),
+            "pwn_count": row.get("PwnCount"),
+        }
+    return out
+
+
+def _from_xposed(body: Any) -> dict[str, dict[str, Any]]:
+    rows = body.get("exposedBreaches") if isinstance(body, dict) else None
+    if not isinstance(rows, list):
+        return {}
+    out: dict[str, dict[str, Any]] = {}
+    for row in rows:
+        if not isinstance(row, dict):
+            continue
+        name = str(row.get("breachID") or "").strip()
+        if not name:
+            continue
+        out[_key(name)] = {
+            "name": name,
+            "date": (row.get("breachedDate") or "")[:10] or None,
+            "data_types": [str(kind) for kind in row.get("exposedData") or []],
+            "domain": row.get("domain"),
+            "pwn_count": row.get("exposedRecords"),
+        }
+    return out
+
+
+async def _download(http: HttpClient) -> dict[str, dict[str, Any]]:
+    try:
+        response = await http.get(HIBP, namespace=NAMESPACE, accept="application/json")
+        if response.status_code == 200:
+            data = _from_hibp(response.json())
+            if data:
+                return data
+    except (OsintKitError, ValueError):
+        pass
+
+    try:
+        response = await http.get(XPOSED, namespace=NAMESPACE, accept="application/json")
+    except OsintKitError:
+        return {}
+    if response.status_code != 200:
+        return {}
+    try:
+        return _from_xposed(response.json())
+    except ValueError:
+        return {}
+
+
+async def fetch(http: HttpClient) -> dict[str, dict[str, Any]]:
+    """Return breach metadata keyed by normalised name, cached for a week."""
+    cached = cache_hit(http.settings, NAMESPACE, "index", TTL)
+    if cached is not None:
+        return cached
+    data = await _download(http)
+    if data:
+        cache_put(http.settings, NAMESPACE, "index", data)
+    return data

{osintkit-0.3.0 → osintkit-0.5.0}/src/osintkit/cli.py

@@ -18,14 +18,17 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.table import Table
 
-from . import __version__, diff, doctor, pipeline, render, retention
+from . import __version__, diff, doctor, passwords, pipeline, render, retention, userconfig
 from .collectors import REGISTRY
 from .config import (
+    DEFAULT_RESOLVERS,
     GENERIC_KEY_ENVS,
+    KEYLESS_PROVIDERS,
     PROVIDERS,
     Settings,
     cache_clear,
     cache_stats,
+    env_key_for,
     provider_from_env,
     provider_from_key,
 )
@@ -71,7 +74,7 @@ def root(
     model: str | None = typer.Option(None, "--model", help="Model name (overrides the provider default)."),
     api_key: str | None = typer.Option(None, "--api-key", help="API key (or set API_KEY)."),
     temperature: float = typer.Option(0.3, "--temperature", min=0.0, max=2.0),
-    max_tokens: int = typer.Option(2400, "--max-tokens", min=256, max=16000),
+    max_tokens: int = typer.Option(4000, "--max-tokens", min=256, max=16000),
     timeout: float = typer.Option(30.0, "--timeout", help="HTTP timeout in seconds."),
     max_connections: int = typer.Option(16, "--max-connections", min=1, max=64),
     max_attempts: int = typer.Option(3, "--max-attempts", min=1, max=6),
@@ -90,19 +93,24 @@ def root(
 ) -> None:
     if provider and provider not in PROVIDERS:
         raise typer.BadParameter(f"unknown provider {provider!r}; choose from {', '.join(PROVIDERS)}")
+    stored = userconfig.load()
     generic_env = next((os.environ[name] for name in GENERIC_KEY_ENVS if os.environ.get(name)), None)
     chosen = (
         provider
         or provider_from_key(api_key)
         or provider_from_env()
         or provider_from_key(generic_env)
+        or stored.get("provider")
         or "venice"
     )
     preset = PROVIDERS[chosen]
+    if not api_key and stored.get("provider") in (None, chosen):
+        api_key = stored.get("api_key")
+    config_applies = stored.get("provider") in (None, chosen)
     settings = Settings(
         provider=chosen,
-        base_url=base_url or preset[0],
-        model=model or preset[1],
+        base_url=base_url or (stored.get("base_url") if config_applies else None) or preset[0],
+        model=model or (stored.get("model") if config_applies else None) or preset[1],
         api_key=api_key,
         temperature=temperature,
         max_tokens=max_tokens,
@@ -112,6 +120,7 @@ def root(
         use_cache=not no_cache,
         cache_ttl=cache_ttl,
         verbose=verbose,
+        resolvers=stored.get("resolvers") or list(DEFAULT_RESOLVERS),
     )
     if resolver:
         for entry in resolver:
@@ -547,6 +556,154 @@ def list_collectors(
     render.console().print(table)
 
 
+@app.command()
+def init(
+    provider: str | None = typer.Option(None, "--provider", help="Provider to store."),
+    api_key: str | None = typer.Option(None, "--api-key", help="Key to store."),
+    model: str | None = typer.Option(None, "--model", help="Default model to store."),
+    base_url: str | None = typer.Option(None, "--base-url", help="Custom endpoint to store."),
+    force: bool = typer.Option(False, "--force", help="Replace an existing config."),
+    verify: bool = typer.Option(True, "--verify/--no-verify", help="Check the key afterwards."),
+) -> None:
+    """Store a provider and key once, then just run lookups."""
+    out = _console()
+    path = userconfig.config_path()
+    if path.exists() and not force:
+        out.print(f"[yellow]config already exists[/yellow] {path}; pass --force to replace")
+        raise typer.Exit(1)
+
+    stored = userconfig.load()
+    detected = (
+        provider
+        or provider_from_env()
+        or provider_from_key(os.environ.get("API_KEY"))
+        or stored.get("provider")
+        or "venice"
+    )
+    chosen = provider or typer.prompt("Provider", default=detected).strip()
+    if chosen not in PROVIDERS:
+        out.print(f"[red]unknown provider {chosen!r}[/red]; choose from {', '.join(PROVIDERS)}")
+        raise typer.Exit(2)
+
+    data: dict[str, object] = {"provider": chosen}
+    if base_url:
+        data["base_url"] = base_url
+    if model:
+        data["model"] = model
+
+    if chosen not in KEYLESS_PROVIDERS:
+        key = (
+            api_key
+            or env_key_for(chosen)
+            or (stored.get("api_key") if stored.get("provider") == chosen else None)
+            or typer.prompt("API key", hide_input=True).strip()
+        )
+        if not key:
+            out.print("[red]no key given[/red]")
+            raise typer.Exit(2)
+        data["api_key"] = key
+
+    written = userconfig.save(data)
+    out.print(f"[green]stored[/green] {written} (mode 600)")
+    out.print(f"provider: {chosen}")
+    if data.get("api_key"):
+        out.print(f"key: {userconfig.mask(str(data['api_key']))}")
+
+    if verify:
+        probe = Settings(
+            provider=chosen,
+            base_url=str(data.get("base_url") or PROVIDERS[chosen][0]),
+            model=str(data.get("model") or PROVIDERS[chosen][1]),
+            api_key=str(data["api_key"]) if data.get("api_key") else None,
+            use_cache=False,
+        )
+        checks = asyncio.run(doctor.diagnose(probe, deep=True))
+        endpoint = checks[-1]
+        if doctor.failed(checks):
+            out.print(f"[red]{endpoint.detail}[/red]")
+            out.print("[dim]config kept; fix it with osintkit init --force[/dim]")
+            raise typer.Exit(1)
+        out.print(f"[green]{endpoint.detail}[/green]")
+    out.print("[dim]try: osintkit lookup --domain example.com[/dim]")
+
+
+@app.command()
+def password(
+    value: str | None = typer.Argument(None, help="Password to check; prompt if omitted."),
+    json_out: bool = typer.Option(False, "--json", help="JSON output."),
+) -> None:
+    """Check a password against Pwned Passwords, without sending it."""
+    out = _console()
+    secret = value
+    if not secret:
+        if not sys.stdin.isatty():
+            secret = sys.stdin.readline().rstrip("\n")
+        if not secret:
+            secret = typer.prompt("Password", hide_input=True)
+    if not secret:
+        out.print("[red]no password given[/red]")
+        raise typer.Exit(2)
+
+    settings: Settings = STATE["settings"]  # type: ignore[assignment]
+
+    async def run() -> dict[str, object]:
+        from .http import HttpClient
+
+        async with HttpClient(settings) as http:
+            return await passwords.check(http, secret)
+
+    try:
+        result = asyncio.run(run())
+    except OsintKitError as exc:
+        out.print(f"[red]{exc}[/red]")
+        raise typer.Exit(1) from exc
+
+    if json_out:
+        print(json.dumps(result, indent=2))
+        return
+    if result["pwned"]:
+        out.print(
+            f"[red]pwned[/red] {result['count']:,} times "
+            f"({result['rating']}); still only the first 5 SHA-1 characters left this machine"
+        )
+        raise typer.Exit(1)
+    out.print(f"[green]not seen[/green] in Pwned Passwords (checked by hash prefix {result['prefix']})")
+    out.print("[yellow]absence is not proof of strength; length and uniqueness still matter[/yellow]")
+
+
+@app.command("config")
+def config_cmd(
+    reveal: bool = typer.Option(False, "--reveal", help="Show the key in full."),
+    unset: list[str] | None = typer.Option(None, "--unset", help="Remove a key."),
+    path_only: bool = typer.Option(False, "--path", help="Print the config path only."),
+) -> None:
+    """Show, reveal, or clear the stored configuration."""
+    out = _console()
+    if path_only:
+        print(userconfig.config_path())
+        return
+    stored = userconfig.load()
+    if unset:
+        for name in unset:
+            stored.pop(name, None)
+        userconfig.save(stored)
+        out.print(f"[green]removed[/green] {', '.join(unset)}")
+        stored = userconfig.load()
+    if not stored:
+        out.print(f"[dim]no config at {userconfig.config_path()}[/dim]")
+        return
+    out.print(f"[dim]{userconfig.config_path()}[/dim]")
+    table = Table(box=box.SIMPLE_HEAD, title="config")
+    table.add_column("key")
+    table.add_column("value")
+    for name, value in stored.items():
+        shown: object = value
+        if name == "api_key" and isinstance(value, str) and not reveal:
+            shown = userconfig.mask(value)
+        table.add_row(name, render.escape(str(shown)))
+    out.print(table)
+
+
 @app.command("doctor")
 def doctor_cmd(
     json_out: bool = typer.Option(False, "--json", help="JSON output."),

{osintkit-0.3.0 → osintkit-0.5.0}/src/osintkit/config.py

@@ -60,6 +60,13 @@ def provider_from_key(api_key: str | None) -> str | None:
     return None
 
 
+def env_key_for(provider: str) -> str | None:
+    for variable, name in PROVIDER_ENV.items():
+        if name == provider and os.environ.get(variable):
+            return os.environ[variable]
+    return None
+
+
 def provider_from_env() -> str | None:
     """Infer a provider from whichever provider-specific variable is set."""
     for variable, provider in PROVIDER_ENV.items():
@@ -103,7 +110,7 @@ class Settings:
     model: str = DEFAULT_MODEL
     api_key: str | None = None
     temperature: float = DEFAULT_TEMPERATURE
-    max_tokens: int = 2400
+    max_tokens: int = 4000
     timeout: float = DEFAULT_TIMEOUT
     max_connections: int = 16
     max_attempts: int = DEFAULT_MAX_ATTEMPTS

{osintkit-0.3.0 → osintkit-0.5.0}/src/osintkit/doctor.py

@@ -7,6 +7,7 @@ import tempfile
 from dataclasses import dataclass, replace
 from pathlib import Path
 
+from . import userconfig
 from .config import PROVIDER_ENV, Settings, cache_dir, ensure_dirs, log_dir
 from .http import HttpClient
 
@@ -102,8 +103,14 @@ def collect_checks(settings: Settings) -> list[Check]:
         key_check = Check("api key", "ok", f"from {source}")
     else:
         key_check = Check("api key", "warn", f"no key for {settings.provider}; set one or use --offline")
+    config = userconfig.config_path()
     checks = [
         Check("provider", "ok", settings.provider),
+        Check(
+            "config file",
+            "ok" if config.exists() else "warn",
+            str(config) if config.exists() else f"none at {config}; run osintkit init",
+        ),
         key_check,
         Check(
             "cache dir",

{osintkit-0.3.0 → osintkit-0.5.0}/src/osintkit/llm.py

@@ -34,7 +34,7 @@ class LLMClient:
         messages: Sequence[Mapping[str, str]],
         *,
         temperature: float | None = None,
-        max_tokens: int = 2400,
+        max_tokens: int = 4000,
         response_format: Mapping[str, Any] | None = None,
     ) -> str:
         api_key = self.settings.resolved_api_key()
@@ -51,6 +51,15 @@ class LLMClient:
         if response_format:
             payload["response_format"] = dict(response_format)
 
+        content, finish = await self._post(payload, api_key)
+        if finish == "length" and not content and max_tokens < 8000:
+            payload["max_tokens"] = min(8000, max_tokens * 2)
+            content, finish = await self._post(payload, api_key)
+        if finish == "length" and not content:
+            raise SynthesisError("model ran out of tokens before answering")
+        return content
+
+    async def _post(self, payload: dict[str, Any], api_key: str | None) -> tuple[str, str | None]:
         try:
             response = await self._http.post_json(
                 self.endpoint(),
@@ -69,7 +78,17 @@ class LLMClient:
             body = response.json()
         except ValueError as exc:
             raise SynthesisError("Model endpoint returned non-JSON") from exc
-        return extract_content(body)
+        return extract_content(body), extract_finish(body)
+
+
+def extract_finish(body: Any) -> str | None:
+    if not isinstance(body, dict):
+        return None
+    choices = body.get("choices")
+    if not isinstance(choices, list) or not choices:
+        return None
+    finish = choices[0].get("finish_reason")
+    return finish if isinstance(finish, str) else None
 
 
 def extract_content(body: Any) -> str:
@@ -86,6 +105,6 @@ def extract_content(body: Any) -> str:
     if isinstance(content, list):
         parts = [c.get("text", "") for c in content if isinstance(c, dict)]
         content = "".join(parts)
-    if not isinstance(content, str) or not content.strip():
-        raise SynthesisError("Model returned empty content")
+    if not isinstance(content, str):
+        return ""
     return content