scamscript 0.2.0__py3-none-any.whl

scamscript/verify.py

@@ -0,0 +1,103 @@
+"""Check model quotations against the source script."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from difflib import SequenceMatcher
+
+from scamscript.models import ScriptBreakdown
+
+QUOTE_PATTERN = re.compile(r"[\"“”'‘’]([^\"“”'‘’]{8,400})[\"“”'‘’]")
+WORD = re.compile(r"[a-z0-9]+")
+MIN_QUOTE_WORDS = 3
+CLOSE_RATIO = 0.75
+
+FIELDS = ("opening_hook", "red_flags")
+
+
+@dataclass(slots=True)
+class Issue:
+    field: str
+    quote: str
+    status: str
+    ratio: float = 0.0
+
+    @property
+    def ok(self) -> bool:
+        return self.status == "verbatim"
+
+
+def normalize(text: str) -> str:
+    lowered = (
+        text.lower()
+        .replace("“", '"')
+        .replace("”", '"')
+        .replace("‘", "'")
+        .replace("’", "'")
+        .replace("–", "-")
+        .replace("—", "-")
+    )
+    return " ".join(re.sub(r"[^a-z0-9 ]+", " ", lowered).split())
+
+
+def extract_quotes(value: str) -> list[str]:
+    quotes = [match.group(1).strip() for match in QUOTE_PATTERN.finditer(value)]
+    return [quote for quote in quotes if len(WORD.findall(quote)) >= MIN_QUOTE_WORDS]
+
+
+def classify(quote: str, source: str) -> tuple[str, float]:
+    """Return (status, ratio) for one quote against the source."""
+    needle = normalize(quote)
+    if not needle:
+        return "missing", 0.0
+    hay = normalize(source)
+    if needle in hay:
+        return "verbatim", 1.0
+
+    words = needle.split()
+    hay_words = hay.split()
+    window = len(words)
+    step = max(1, window // 3)
+    best = 0.0
+    for start in range(0, max(1, len(hay_words) - window + 1), step):
+        candidate = " ".join(hay_words[start : start + window])
+        ratio = SequenceMatcher(None, needle, candidate).ratio()
+        if ratio > best:
+            best = ratio
+            if best >= 0.97:
+                break
+    if best >= CLOSE_RATIO:
+        return "close", round(best, 3)
+    return "missing", round(best, 3)
+
+
+def verify_breakdown(breakdown: ScriptBreakdown, source: str) -> list[Issue]:
+    """Check quoted claims in the hook and red flags. Paraphrase without quotes is skipped."""
+    issues: list[Issue] = []
+    for field in FIELDS:
+        value = getattr(breakdown, field)
+        values = value if isinstance(value, list) else [value]
+        for item in values:
+            if not item:
+                continue
+            quotes = extract_quotes(item)
+            if not quotes and field == "opening_hook" and len(WORD.findall(item)) >= 4:
+                quotes = [item]
+            for quote in quotes:
+                status, ratio = classify(quote, source)
+                issues.append(
+                    Issue(field=field, quote=quote.strip(), status=status, ratio=ratio)
+                )
+    return issues
+
+
+def summarize(issues: list[Issue]) -> dict[str, int]:
+    counts = {"checked": len(issues), "verbatim": 0, "close": 0, "missing": 0}
+    for issue in issues:
+        counts[issue.status] = counts.get(issue.status, 0) + 1
+    return counts
+
+
+def has_problems(issues: list[Issue]) -> bool:
+    return any(issue.status != "verbatim" for issue in issues)

scamscript-0.2.0.dist-info/METADATA

@@ -0,0 +1,278 @@
+Metadata-Version: 2.5
+Name: scamscript
+Version: 0.2.0
+Summary: Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks
+Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/scamscript
+Project-URL: Repository, https://github.com/sjdsjadjajdjsa/scamscript
+Project-URL: Issues, https://github.com/sjdsjadjajdjsa/scamscript/issues
+Project-URL: Changelog, https://github.com/sjdsjadjajdjsa/scamscript/blob/master/CHANGELOG.md
+Author-email: scamscript contributors <313729361+sjdsjadjajdjsa@users.noreply.github.com>
+Maintainer-email: scamscript contributors <313729361+sjdsjadjajdjsa@users.noreply.github.com>
+License: MIT License
+        
+        Copyright (c) 2026 scamscript contributors
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: cli,fraud,osint,phishing,scam,security,smishing,social-engineering,transcripts,vishing
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: Science/Research
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: httpx==0.28.1
+Requires-Dist: pydantic==2.14.2
+Requires-Dist: rich==15.0.0
+Requires-Dist: typer==0.27.3
+Provides-Extra: dev
+Requires-Dist: build==1.3.0; extra == 'dev'
+Requires-Dist: pytest==8.4.1; extra == 'dev'
+Requires-Dist: twine==6.1.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+<p align="center">
+  <img src="docs/banner.svg" alt="scamscript: reverse-engineer the playbook, not the story" width="100%">
+</p>
+
+<p align="center">
+  <img src="docs/demo.gif" alt="terminal demo: analyzing a script, then ranking a directory" width="760">
+  <br>
+  <sub>Recorded against a local stub endpoint, so no API spend.</sub>
+</p>
+
+# scamscript
+
+[![CI](https://github.com/sjdsjadjajdjsa/scamscript/actions/workflows/ci.yml/badge.svg)](https://github.com/sjdsjadjajdjsa/scamscript/actions/workflows/ci.yml)
+[![Python](https://img.shields.io/badge/python-3.12%20%7C%203.13-3776ab)](pyproject.toml)
+[![License](https://img.shields.io/badge/license-MIT-2a9d8f)](LICENSE)
+[![Scope](https://img.shields.io/badge/scope-security%20research-e63946)](#scope-and-disclaimer)
+
+A reverse-engineering analyzer for leaked or public scam call scripts and vishing transcripts.
+Point it at a script and a model takes the fraud apart: the persona, the hook that catches you,
+how trust is manufactured, the pressure applied, what happens when you hesitate, and how to
+counter that exact playbook.
+
+> **Security research and fraud-awareness training only.** Output is a model-produced reading of
+> a captured script, not legal advice and not attribution. A script is evidence of a *pattern*;
+> the live scam that reuses it will differ in details.
+
+---
+
+## Why
+
+Scripts leak. Call centres dump their flows, victims publish transcripts, researchers collect
+samples. Reading them one by one teaches you that `your account is at risk` is bad, but not how a
+particular operation sequences trust into a transfer. This tool turns each artifact into a
+comparable record, so a corpus can be ranked and a defender's briefing can quote the actual
+mechanics instead of general advice.
+
+## Quickstart
+
+```bash
+pip install scamscript           # or, for development:
+# git clone https://github.com/sjdsjadjajdjsa/scamscript && cd scamscript && pip install -e ".[dev]"
+
+export API_KEY=...               # never committed, never logged
+
+scamscript --dry-run analyze --file examples/tech_support_scam.txt   # inspect the prompt, spend nothing
+scamscript analyze --file examples/tech_support_scam.txt
+```
+
+Any OpenAI-compatible `/chat/completions` endpoint works. Defaults are Venice with
+`deepseek-v4-1-flash-1017-uncensored`; OpenRouter needs only the model slug:
+
+```bash
+scamscript --base-url https://openrouter.ai/api/v1 \
+  --model deepseek/deepseek-v4.1-flash-1017 analyze --file script.txt
+```
+
+## What it produces
+
+Each script renders as a colour-coded panel:
+
+```text
+╭──────────────────────────── tech_support_scam.txt ────────────────────────────╮
+│ ATTACK TYPE   TECH SUPPORT SCAM     SOPHISTICATION  6/10                     │
+│                                                                              │
+│ OPENING HOOK                                                                 │
+│   "Our telemetry shows your machine has been broadcasting error ..."         │
+│                                                                              │
+│ RED FLAGS                                                                    │
+│   ✗ Unsolicited call claiming Windows telemetry                              │
+│   ✗ Caller asks for a Remote Desktop session ID                              │
+╰────────────────────────────────── 7 red flags ───────────────────────────────╯
+```
+
+Fields: `attack_type`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
+`escalation_ladder`, `target_demographics`, `red_flags`, `defense_summary`, `sophistication_score`.
+
+The panel also carries a **quote check**: every quoted claim in `opening_hook` and `red_flags` is
+compared against the source, and lines that are paraphrased or simply not there are marked. Use
+`--strict-quotes` to make a missing line fail the run, and `--no-verify` to skip it.
+
+Batch mode ranks a whole directory into one markdown report. A redacted report from the sample
+corpus is at [`docs/sample-report.md`](docs/sample-report.md).
+
+## Commands
+
+| Command | Purpose |
+| --- | --- |
+| `analyze --file` | Break down one script |
+| `analyze --dir --batch` | Directory, aggregated report |
+| `batch <dir>` | Same as above, ranked |
+| `report --run-id` | Regenerate a report from a past run's log |
+| `history` | List previous runs |
+| `prune` | Delete old logs |
+
+Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
+`--retries`, `--max-tokens`, `--no-color`. `--json` puts one object per script on stdout and all
+Rich output on stderr, so it pipes:
+
+```bash
+scamscript --json batch examples | jq -s 'map(select(.event == "result")) | length'
+```
+
+## How it works
+
+```text
+script ──▶ ingest (type/size guards, optional redaction)
+        ──▶ analyst prompt ──▶ /chat/completions
+        ──▶ JSON extraction ──▶ Pydantic schema
+                 │ invalid / truncated
+                 └──▶ one repair retry with the error fed back
+        ──▶ Rich panel  |  JSONL record  |  ranked markdown
+```
+
+- **Validation.** Replies are parsed tolerantly (fences, prose, string lists, `9/10` scores) and
+  then validated. One malformed reply earns exactly one repair attempt; a second failure is
+  reported, not retried forever.
+- **Transport.** Retryable statuses (408, 409, 425, 429, 5xx) and empty replies back off and
+  retry within `--retries`; `Retry-After` is honoured. A `finish_reason: length` reply is treated
+  as truncation and repaired with a shorter-answer instruction.
+- **Reasoning models.** If a provider returns only reasoning text with `finish_reason: length`, the
+  client treats it as truncation, and when a provider parks the answer in `reasoning` with an empty
+  `content`, that text is used as a last resort. Raise `--max-tokens` for models that think first.
+- **Quote checking.** Quoted claims are normalised (case, quotes, punctuation) and matched against
+  the script. `close` means a paraphrase, `missing` means the line is not in the artifact.
+  Verification never drops a finding, it only marks it for the reader.
+- **Scoring.** `sophistication_score` follows fixed anchors (1-2 one device, 5-6 staged trust and
+  one deadline, 9-10 rehearsed objection handling and controlled transfers) so rankings compare
+  across runs instead of drifting with prose.
+
+## Redaction and logs
+
+`--redact` masks emails, card numbers, SSNs, phone numbers and long digit runs before the prompt
+is sent, before anything is logged, and inside the returned breakdown. Counts are logged. Regex
+masking is best effort: names, case IDs and spelled-out digits survive it.
+
+Every request appends to a timestamped JSONL file under `~/.scamscript/logs/` (override with
+`--home` or `SCAMSCRIPT_HOME`). The API key is never written. Logs are the source for `report`, so
+a run replays without spending tokens, and `prune --keep 200 --keep-days 30` keeps the store
+bounded.
+
+## Install and configure
+
+Python 3.12+. `pip install scamscript` for use, `pip install -e ".[dev]"` from a clone for tests.
+Release history is in [CHANGELOG.md](CHANGELOG.md).
+
+| Setting | Flag | Env | Default |
+| --- | --- | --- | --- |
+| API key | `--api-key` | `API_KEY` | none, required unless `--dry-run` |
+| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | `https://api.venice.ai/api/v1` |
+| Model | `--model` | `SCAMSCRIPT_MODEL` | `deepseek-v4-1-flash-1017-uncensored` |
+| State dir | `--home` | `SCAMSCRIPT_HOME` | `~/.scamscript` |
+
+## Tests, CI and calibration
+
+```bash
+pytest
+```
+
+The suite mocks the HTTP layer with `httpx.MockTransport`; no network or key needed. CI runs the
+suite and a wheel build on Python 3.12 and 3.13.
+
+Calibration is evidence, not vibes. `scripts/calibrate.py` measures first-attempt schema
+adherence, repair rate, latency, score spread and billed cost against a live endpoint:
+
+```bash
+API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017 \
+  --base-url https://openrouter.ai/api/v1
+```
+
+Recorded passes with their numbers are in [`docs/calibration.md`](docs/calibration.md): three rubric
+repeats, a three-model comparison, an adversarial set and end-case stability runs. The current rubric
+reaches both ends of the scale, and quote checking flags the invented lines a plain reading would
+take as evidence.
+
+The adversarial set lives in `examples/adversarial/` and has its own harness:
+
+```bash
+API_KEY=... python scripts/injection_eval.py --model ... --base-url ...
+```
+
+Format held in 7/7 cases; embedded demands were obeyed in 1 of 6. The fence protects the schema, not
+the classification.
+
+## Layout
+
+```text
+src/scamscript/
+  cli.py        command wiring, exit codes
+  client.py     OpenAI-compatible client, retries, truncation
+  analysis.py   per-script loop, one repair retry
+  ingest.py     file and directory reading with guards
+  models.py     Pydantic schema, tolerant JSON extraction
+  prompts.py    analyst prompt and score rubric
+  redact.py     identifier masking
+  render.py     Rich panels and summary
+  report.py     ranked markdown aggregation
+  store.py      JSONL log, run discovery, retention
+  verify.py     quote checking against the source
+tests/          schema, retry, redaction, verification, client and CLI tests
+examples/       six fictional transcripts, plus adversarial/ fixtures
+scripts/        calibration and injection harnesses
+docs/           calibration record, sample report, banner, demo
+```
+
+## Limits
+
+- Breakdowns are model readings; a bad prompt or a weak model produces confident nonsense. Read
+  `opening_hook` and `red_flags` against the source before quoting anything.
+- Redaction is regex-based and will miss names and identifiers without a fixed shape.
+- One script per request; no cross-script deduplication yet, so reprints inflate a ranking.
+- Analysis is English-centric: the prompt and schema assume English artifacts.
+- Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;
+  an accurate paraphrase without quotes is skipped rather than judged.
+
+## Scope and disclaimer
+
+For security research and fraud-awareness training only. Not legal advice, not an attribution
+tool, no warranty. Keep API keys out of commits; the key is read from the environment.
+
+MIT licensed, see [LICENSE](LICENSE). Contribution notes in [CONTRIBUTING.md](CONTRIBUTING.md),
+vulnerability reports in [SECURITY.md](.github/SECURITY.md).

scamscript-0.2.0.dist-info/RECORD

@@ -0,0 +1,19 @@
+scamscript/__init__.py,sha256=ve6tW4xYXG0aWgQdTqxFMv7YyUwjxn3_PoLfAFQjpJg,93
+scamscript/__main__.py,sha256=1FkTauyNgx-VTivcgblCC--ehR94Le1jOwKbqsaPtNI,69
+scamscript/analysis.py,sha256=PzHgxwdWyuXMltRyPO8bu0B7Ps0GQn8axlG7otCPxis,4483
+scamscript/cli.py,sha256=wwr0iPTmPvrjkx53tnti03vfR3X5HkAnaymGoYIH4VA,16871
+scamscript/client.py,sha256=IXoCpTaI0dY56E_IUlWHKgC0ncF97-ZQ5owo8n7c1yo,6734
+scamscript/config.py,sha256=Zp1dzQMhR7T4lM-rgv9n-CrGSI8TT2MCOOcw8JunGSM,1628
+scamscript/ingest.py,sha256=UK0dKuz0DiIVNYRlqOXrsppdXfD2_SB6aQ2xa9XtdYM,2639
+scamscript/models.py,sha256=XvEeRrOdTK-94Qf9kylcumTCtlK5sLpuslLRI4k5f50,4935
+scamscript/prompts.py,sha256=OjvdE--4LLi-KGgt5ofctBVfAjSBIOS_-sVpmeG7vMo,4896
+scamscript/redact.py,sha256=XRtoyICpvHa_ShutSY7xPI-CA2ynwl1mhMrKG5Ku-J4,1885
+scamscript/render.py,sha256=77h2SAyfxuVkdQ2JeNZTpmahevUh4emNEKGsiVbUOLo,7309
+scamscript/report.py,sha256=7qPAoM2ySmH6fP7gov4Xd7tDNpDerl2n_u1tLzHYulE,6970
+scamscript/store.py,sha256=ivqpkK9-4ZLjpwhTfbyfKdUi3SLQRLcdHz3raJcDDuA,5694
+scamscript/verify.py,sha256=r-LAsixI0VBhS8B1kysGpOH25gFNxTOx8YWShqKTrSY,3136
+scamscript-0.2.0.dist-info/METADATA,sha256=O9tXoKOAsJ27dWVxsX-SNY0tMmUAFMlP686KB6uySUc,13564
+scamscript-0.2.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+scamscript-0.2.0.dist-info/entry_points.txt,sha256=0_9QvsVOPGBfHyKJeIuMRipxlZ93RkSzBi0BbuVxRFw,50
+scamscript-0.2.0.dist-info/licenses/LICENSE,sha256=igeAjcsoQ1OuxBrqTyijwNZ9mcsYmJLkLfn7M5rmGg4,1080
+scamscript-0.2.0.dist-info/RECORD,,

scamscript-0.2.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

scamscript-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+scamscript = scamscript.cli:app

scamscript-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 scamscript contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.