scamscript 0.2.0__tar.gz

scamscript-0.2.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,46 @@
+name: Bug report
+description: Something broke, or a breakdown is unusable
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For security problems use the private advisory link instead.
+        Never paste a live API key.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: output of `scamscript --version` or `git rev-parse --short HEAD`
+    validations:
+      required: true
+  - type: dropdown
+    id: command
+    attributes:
+      label: Command
+      options: [analyze, batch, report, history, prune, other]
+    validations:
+      required: true
+  - type: input
+    id: provider
+    attributes:
+      label: Endpoint and model
+      placeholder: base URL and model slug, key redacted
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction
+      description: Smallest command and script fragment that shows the problem
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected and actual
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log lines or error text
+      description: From ~/.scamscript/logs/, trimmed to the failing record

scamscript-0.2.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security advisory
+    url: https://github.com/sjdsjadjajdjsa/scamscript/security/advisories/new
+    about: Private reports for injection, leakage and path issues.

scamscript-0.2.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: A new analysis field, output format or command
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What can you not answer today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: Where it fits in the flow, and what it changes in the schema or CLI
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Fit
+      options:
+        - label: Works offline for tests
+        - label: Keeps `--json` one object per line
+        - label: Does not need a new dependency (or the dependency is justified)

scamscript-0.2.0/.github/SECURITY.md

@@ -0,0 +1,40 @@
+# Security policy
+
+## Reporting a problem
+
+Open a private advisory through
+[GitHub Security Advisories](https://github.com/sjdsjadjajdjsa/scamscript/security/advisories/new)
+for anything that is not a plain bug. Include the version or commit, the command, and the smallest
+reproduction you can manage.
+
+Expect an acknowledgement within a week. This is a side project with no bounty.
+
+## What counts
+
+- Prompt injection in a script that escapes the JSON contract or smuggles instructions into the
+  logged record.
+- Log or report leakage of data the redactor claims to mask.
+- Path handling problems in `--file`, `--dir` or `--output` (traversal, symlink surprises,
+  clobbering).
+- Anything that makes an API key appear in output, logs or a commit.
+
+## What does not
+
+- A model producing a wrong or shallow breakdown. That is a calibration issue, not a
+  vulnerability; see `docs/calibration.md`.
+- A malicious script that the analyzer does not classify correctly.
+- Findings in upstream libraries without a demonstration against this tool.
+
+## Handling keys and data
+
+- The key is read from `API_KEY` or `--api-key` and never written to logs.
+- Scripts leave the machine when you run an analysis. With `--redact`, likely identifiers are
+  masked first, but redaction is regex-based: names and free-form identifiers still reach the
+  provider.
+- Logs under `~/.scamscript/logs/` contain model output, which can echo the script. Prune them or
+  point `--home` at disposable storage when working with sensitive captures.
+
+## Scope
+
+Supported: the current `master`. There are no backports and no LTS branches. Scripts are treated
+as untrusted input; the tool reads them and never executes them.

scamscript-0.2.0/.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## What and why
+
+<!-- One paragraph. The problem, not the file list. -->
+
+## Checklist
+
+- [ ] `pytest` passes, no network in tests
+- [ ] New tolerance or validator behaviour has a test, including the failure path
+- [ ] Schema changes touch models, prompt, render, report and the README field list
+- [ ] Prompt or scoring changes include before/after calibration numbers
+- [ ] No keys, logs, `.venv/` or real victim data in the diff

scamscript-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        run: python -m pip install -e ".[dev]"
+      - name: Test
+        run: python -m pytest
+      - name: Build wheel
+        run: python -m pip wheel . --no-deps -w dist
+      - name: Smoke the entry point
+        run: python -m scamscript --version

scamscript-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,69 @@
+name: Publish
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      repository:
+        description: Target index
+        type: choice
+        options: [pypi, testpypi]
+        default: testpypi
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Build
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+      - name: Check metadata
+        run: python -m twine check dist/*
+      - name: Smoke the wheel
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install dist/*.whl
+          /tmp/smoke/bin/scamscript --version
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  testpypi:
+    needs: build
+    if: github.event_name == 'workflow_dispatch' && inputs.repository == 'testpypi'
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  pypi:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.repository == 'pypi')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

scamscript-0.2.0/.gitignore

@@ -0,0 +1,9 @@
+.venv/
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.pytest_cache/
+.crush/
+*.md.out

scamscript-0.2.0/CHANGELOG.md

@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes are recorded here. Versions follow SemVer; the CLI surface and the JSON
+schema are the things that count as public API.
+
+## Unreleased
+
+### Added
+
+- Terminal demo GIF in the README, recorded against a local stub endpoint.
+
+## 0.2.0 - 2026-11-02
+
+### Added
+
+- Quote verification: quoted claims in `opening_hook` and `red_flags` are matched against the
+  source and marked `close` or `missing`; `--strict-quotes` fails the run, `--no-verify` disables.
+- `--json` output (one object per script on stdout), `--timeout`, `--retries`, `--max-tokens`.
+- `prune` command and `store.prune` for log retention.
+- `--redact` masking of emails, cards, SSNs, phone numbers and long digit runs.
+- Adversarial fixture set and `scripts/injection_eval.py` harness.
+- `scripts/calibrate.py` for adherence, latency, spread and cost measurement.
+- `docs/calibration.md` with three recorded passes and their caveats.
+- CI on Python 3.12 and 3.13, issue forms, PR template, code of conduct, citation metadata.
+
+### Changed
+
+- Prompt fences the artifact as untrusted data and states embedded instructions cannot change the
+  output format.
+- Sophistication anchors widened; 9-10 now reserved for the top decile.
+- Reason-only replies: `length` with empty content is truncation, reasoning text is the partial and
+  a last-resort fallback.
+
+### Fixed
+
+- Empty content and retryable statuses were treated as fatal; they now back off within `--retries`.
+- README, banner and repository metadata rebuilt around scope and evidence.
+
+## 0.1.0 - 2026-11-01
+
+### Added
+
+- First cut: `analyze`, `batch`, `report`, `history`, `--dry-run`, Rich panels, ranked markdown
+  reports, Pydantic schema with one repair retry, JSONL logging, three sample transcripts, tests,
+  and a pip-installable package with a `scamscript` entry point.

scamscript-0.2.0/CITATION.cff

@@ -0,0 +1,20 @@
+cff-version: 1.2.0
+title: scamscript
+message: If this tool contributes to published research, cite the repository at the version used.
+type: software
+authors:
+  - name: scamscript contributors
+repository-code: https://github.com/sjdsjadjajdjsa/scamscript
+license: MIT
+abstract: >-
+  Reverse-engineering analyzer for leaked and public scam call scripts and vishing transcripts.
+  Turns a script into a validated breakdown of persona, hook, trust moves, urgency, escalation,
+  red flags and a counter-playbook.
+keywords:
+  - security
+  - fraud
+  - vishing
+  - smishing
+  - social engineering
+version: 0.1.0
+date-released: 2026-11-01

scamscript-0.2.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,21 @@
+# Code of conduct
+
+Short version: be useful, be kind, assume the other person is trying.
+
+## Expected
+
+- Critique the change, not the person.
+- Say what evidence would change your mind.
+- Accept that maintainers can say no to scope, even to good work.
+
+## Not expected
+
+- Harassment, dogpiling, or gatekeeping over tooling choices.
+- Pasting live API keys or embargoed victim data into issues.
+- Drive-by rewrites with no test and no rationale.
+
+## Enforcement
+
+Report problems through a GitHub issue or the security advisory link. A maintainer will confirm,
+explain the call and, for repeat behaviour, limit participation. There is no committee and no
+appeal process beyond asking again with new detail.

scamscript-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,54 @@
+# Contributing
+
+Small project, low ceremony. Two rules: keep tests offline, and treat prompt or schema changes as
+behaviour changes.
+
+## Setup
+
+```bash
+python -m venv .venv && . .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+```
+
+## Before opening a PR
+
+- `pytest` passes. The suite mocks HTTP with `httpx.MockTransport`; nothing may hit a real network
+  or need a key.
+- New parser tolerance or validator behaviour comes with a test, including the failure path.
+- Additions to the schema touch `models.py`, `prompts.py`, `render.py`, `report.py` and the README
+  field list together; a half-wired field is worse than none.
+- Keep the CLI contract stable: global flags stay global, exit code 1 means at least one script
+  failed, and `--json` output stays one object per line on stdout.
+
+## Prompt and scoring changes
+
+Prompts are code. If you change the analyst instructions or the sophistication anchors, run the
+calibration harness against a live endpoint and paste the before/after numbers into the PR:
+
+```bash
+API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017 \
+  --base-url https://openrouter.ai/api/v1
+```
+
+Reference figures live in `docs/calibration.md`. A change that raises repair rate or drops
+first-attempt validity needs a justification beyond "the output reads nicer".
+
+## Samples
+
+`examples/` holds fictional transcripts only. Mark the top of each file as fictional, keep brands
+invented, and do not paste victim data that is still under an embargo. If you add a real transcript,
+note its provenance in the header comment.
+
+## Style
+
+- Standard library first; new dependencies need a pinned version and a reason.
+- Type hints on public functions, `from __future__ import annotations` at the top.
+- No comments that restate the code; explain the reason when it is not obvious.
+- Keep user-facing strings plain and lowercase for errors, sentence case for help text.
+
+## Commits
+
+One logical change per commit. Subject under 72 characters, imperative mood, body explains why.
+Do not commit `.venv/`, logs or keys.

scamscript-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 scamscript contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.