scamscript 0.2.0__tar.gz → 0.3.0__tar.gz

{scamscript-0.2.0 → scamscript-0.3.0}/CHANGELOG.md

@@ -5,6 +5,21 @@ schema are the things that count as public API.
 
 ## Unreleased
 
+## 0.3.0 - 2026-11-02
+
+### Changed
+
+- Breaking: no default provider or model. `--base-url` and `--model` (or `SCAMSCRIPT_BASE_URL` /
+  `SCAMSCRIPT_MODEL`) are required for API calls; `--dry-run` works without them.
+
+## 0.2.1 - 2026-11-02
+
+### Fixed
+
+- PyPI project page: absolute image and link URLs so the banner, demo and docs links resolve.
+- License metadata now uses the SPDX expression `MIT` plus `license-files` instead of embedding the
+  full license text in the sidebar.
+
 ### Added
 
 - Terminal demo GIF in the README, recorded against a local stub endpoint.

{scamscript-0.2.0 → scamscript-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scamscript
-Version: 0.2.0
+Version: 0.3.0
 Summary: Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/scamscript
 Project-URL: Repository, https://github.com/sjdsjadjajdjsa/scamscript
@@ -8,27 +8,7 @@ Project-URL: Issues, https://github.com/sjdsjadjajdjsa/scamscript/issues
 Project-URL: Changelog, https://github.com/sjdsjadjajdjsa/scamscript/blob/master/CHANGELOG.md
 Author-email: scamscript contributors <313729361+sjdsjadjajdjsa@users.noreply.github.com>
 Maintainer-email: scamscript contributors <313729361+sjdsjadjajdjsa@users.noreply.github.com>
-License: MIT License
-        
-        Copyright (c) 2026 scamscript contributors
-        
-        Permission is hereby granted, free of charge, to any person obtaining a copy
-        of this software and associated documentation files (the "Software"), to deal
-        in the Software without restriction, including without limitation the rights
-        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-        copies of the Software, and to permit persons to whom the Software is
-        furnished to do so, subject to the following conditions:
-        
-        The above copyright notice and this permission notice shall be included in all
-        copies or substantial portions of the Software.
-        
-        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-        SOFTWARE.
+License-Expression: MIT
 License-File: LICENSE
 Keywords: cli,fraud,osint,phishing,scam,security,smishing,social-engineering,transcripts,vishing
 Classifier: Development Status :: 4 - Beta
@@ -55,11 +35,11 @@ Requires-Dist: twine==6.1.0; extra == 'dev'
 Description-Content-Type: text/markdown
 
 <p align="center">
-  <img src="docs/banner.svg" alt="scamscript: reverse-engineer the playbook, not the story" width="100%">
+  <img src="https://raw.githubusercontent.com/sjdsjadjajdjsa/scamscript/master/docs/banner.svg" alt="scamscript: reverse-engineer the playbook, not the story" width="100%">
 </p>
 
 <p align="center">
-  <img src="docs/demo.gif" alt="terminal demo: analyzing a script, then ranking a directory" width="760">
+  <img src="https://raw.githubusercontent.com/sjdsjadjajdjsa/scamscript/master/docs/demo.gif" alt="terminal demo: analyzing a script, then ranking a directory" width="760">
   <br>
   <sub>Recorded against a local stub endpoint, so no API spend.</sub>
 </p>
@@ -68,7 +48,7 @@ Description-Content-Type: text/markdown
 
 [![CI](https://github.com/sjdsjadjajdjsa/scamscript/actions/workflows/ci.yml/badge.svg)](https://github.com/sjdsjadjajdjsa/scamscript/actions/workflows/ci.yml)
 [![Python](https://img.shields.io/badge/python-3.12%20%7C%203.13-3776ab)](pyproject.toml)
-[![License](https://img.shields.io/badge/license-MIT-2a9d8f)](LICENSE)
+[![License](https://img.shields.io/badge/license-MIT-2a9d8f)](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/LICENSE)
 [![Scope](https://img.shields.io/badge/scope-security%20research-e63946)](#scope-and-disclaimer)
 
 A reverse-engineering analyzer for leaked or public scam call scripts and vishing transcripts.
@@ -96,18 +76,22 @@ mechanics instead of general advice.
 pip install scamscript           # or, for development:
 # git clone https://github.com/sjdsjadjajdjsa/scamscript && cd scamscript && pip install -e ".[dev]"
 
-export API_KEY=...               # never committed, never logged
+export API_KEY=...
+export SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1
+export SCAMSCRIPT_MODEL=deepseek/deepseek-v4.1-flash-1017
 
 scamscript --dry-run analyze --file examples/tech_support_scam.txt   # inspect the prompt, spend nothing
 scamscript analyze --file examples/tech_support_scam.txt
 ```
 
-Any OpenAI-compatible `/chat/completions` endpoint works. Defaults are Venice with
-`deepseek-v4-1-flash-1017-uncensored`; OpenRouter needs only the model slug:
+Any OpenAI-compatible `/chat/completions` endpoint works. There is no baked-in provider or model:
+pass `--base-url` and `--model`, or set `SCAMSCRIPT_BASE_URL` and `SCAMSCRIPT_MODEL`.
 
 ```bash
 scamscript --base-url https://openrouter.ai/api/v1 \
   --model deepseek/deepseek-v4.1-flash-1017 analyze --file script.txt
+
+scamscript --base-url http://localhost:11434/v1 --model llama3.2 analyze --file script.txt
 ```
 
 ## What it produces
@@ -135,7 +119,7 @@ compared against the source, and lines that are paraphrased or simply not there
 `--strict-quotes` to make a missing line fail the run, and `--no-verify` to skip it.
 
 Batch mode ranks a whole directory into one markdown report. A redacted report from the sample
-corpus is at [`docs/sample-report.md`](docs/sample-report.md).
+corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/sample-report.md).
 
 ## Commands
 
@@ -197,13 +181,13 @@ bounded.
 ## Install and configure
 
 Python 3.12+. `pip install scamscript` for use, `pip install -e ".[dev]"` from a clone for tests.
-Release history is in [CHANGELOG.md](CHANGELOG.md).
+Release history is in [CHANGELOG.md](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/CHANGELOG.md).
 
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
 | API key | `--api-key` | `API_KEY` | none, required unless `--dry-run` |
-| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | `https://api.venice.ai/api/v1` |
-| Model | `--model` | `SCAMSCRIPT_MODEL` | `deepseek-v4-1-flash-1017-uncensored` |
+| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | none, required |
+| Model | `--model` | `SCAMSCRIPT_MODEL` | none, required |
 | State dir | `--home` | `SCAMSCRIPT_HOME` | `~/.scamscript` |
 
 ## Tests, CI and calibration
@@ -219,12 +203,12 @@ Calibration is evidence, not vibes. `scripts/calibrate.py` measures first-attemp
 adherence, repair rate, latency, score spread and billed cost against a live endpoint:
 
 ```bash
-API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
-  --model deepseek/deepseek-v4.1-flash-1017 \
-  --base-url https://openrouter.ai/api/v1
+API_KEY=... SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1 \
+  python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017
 ```
 
-Recorded passes with their numbers are in [`docs/calibration.md`](docs/calibration.md): three rubric
+Recorded passes with their numbers are in [`docs/calibration.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/calibration.md): three rubric
 repeats, a three-model comparison, an adversarial set and end-case stability runs. The current rubric
 reaches both ends of the scale, and quote checking flags the invented lines a plain reading would
 take as evidence.
@@ -232,7 +216,7 @@ take as evidence.
 The adversarial set lives in `examples/adversarial/` and has its own harness:
 
 ```bash
-API_KEY=... python scripts/injection_eval.py --model ... --base-url ...
+API_KEY=... SCAMSCRIPT_BASE_URL=... python scripts/injection_eval.py --model ...
 ```
 
 Format held in 7/7 cases; embedded demands were obeyed in 1 of 6. The fence protects the schema, not
@@ -274,5 +258,5 @@ docs/           calibration record, sample report, banner, demo
 For security research and fraud-awareness training only. Not legal advice, not an attribution
 tool, no warranty. Keep API keys out of commits; the key is read from the environment.
 
-MIT licensed, see [LICENSE](LICENSE). Contribution notes in [CONTRIBUTING.md](CONTRIBUTING.md),
+MIT licensed, see [LICENSE](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/LICENSE). Contribution notes in [CONTRIBUTING.md](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/CONTRIBUTING.md),
 vulnerability reports in [SECURITY.md](.github/SECURITY.md).

{scamscript-0.2.0 → scamscript-0.3.0}/README.md

@@ -1,9 +1,9 @@
 <p align="center">
-  <img src="docs/banner.svg" alt="scamscript: reverse-engineer the playbook, not the story" width="100%">
+  <img src="https://raw.githubusercontent.com/sjdsjadjajdjsa/scamscript/master/docs/banner.svg" alt="scamscript: reverse-engineer the playbook, not the story" width="100%">
 </p>
 
 <p align="center">
-  <img src="docs/demo.gif" alt="terminal demo: analyzing a script, then ranking a directory" width="760">
+  <img src="https://raw.githubusercontent.com/sjdsjadjajdjsa/scamscript/master/docs/demo.gif" alt="terminal demo: analyzing a script, then ranking a directory" width="760">
   <br>
   <sub>Recorded against a local stub endpoint, so no API spend.</sub>
 </p>
@@ -12,7 +12,7 @@
 
 [![CI](https://github.com/sjdsjadjajdjsa/scamscript/actions/workflows/ci.yml/badge.svg)](https://github.com/sjdsjadjajdjsa/scamscript/actions/workflows/ci.yml)
 [![Python](https://img.shields.io/badge/python-3.12%20%7C%203.13-3776ab)](pyproject.toml)
-[![License](https://img.shields.io/badge/license-MIT-2a9d8f)](LICENSE)
+[![License](https://img.shields.io/badge/license-MIT-2a9d8f)](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/LICENSE)
 [![Scope](https://img.shields.io/badge/scope-security%20research-e63946)](#scope-and-disclaimer)
 
 A reverse-engineering analyzer for leaked or public scam call scripts and vishing transcripts.
@@ -40,18 +40,22 @@ mechanics instead of general advice.
 pip install scamscript           # or, for development:
 # git clone https://github.com/sjdsjadjajdjsa/scamscript && cd scamscript && pip install -e ".[dev]"
 
-export API_KEY=...               # never committed, never logged
+export API_KEY=...
+export SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1
+export SCAMSCRIPT_MODEL=deepseek/deepseek-v4.1-flash-1017
 
 scamscript --dry-run analyze --file examples/tech_support_scam.txt   # inspect the prompt, spend nothing
 scamscript analyze --file examples/tech_support_scam.txt
 ```
 
-Any OpenAI-compatible `/chat/completions` endpoint works. Defaults are Venice with
-`deepseek-v4-1-flash-1017-uncensored`; OpenRouter needs only the model slug:
+Any OpenAI-compatible `/chat/completions` endpoint works. There is no baked-in provider or model:
+pass `--base-url` and `--model`, or set `SCAMSCRIPT_BASE_URL` and `SCAMSCRIPT_MODEL`.
 
 ```bash
 scamscript --base-url https://openrouter.ai/api/v1 \
   --model deepseek/deepseek-v4.1-flash-1017 analyze --file script.txt
+
+scamscript --base-url http://localhost:11434/v1 --model llama3.2 analyze --file script.txt
 ```
 
 ## What it produces
@@ -79,7 +83,7 @@ compared against the source, and lines that are paraphrased or simply not there
 `--strict-quotes` to make a missing line fail the run, and `--no-verify` to skip it.
 
 Batch mode ranks a whole directory into one markdown report. A redacted report from the sample
-corpus is at [`docs/sample-report.md`](docs/sample-report.md).
+corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/sample-report.md).
 
 ## Commands
 
@@ -141,13 +145,13 @@ bounded.
 ## Install and configure
 
 Python 3.12+. `pip install scamscript` for use, `pip install -e ".[dev]"` from a clone for tests.
-Release history is in [CHANGELOG.md](CHANGELOG.md).
+Release history is in [CHANGELOG.md](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/CHANGELOG.md).
 
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
 | API key | `--api-key` | `API_KEY` | none, required unless `--dry-run` |
-| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | `https://api.venice.ai/api/v1` |
-| Model | `--model` | `SCAMSCRIPT_MODEL` | `deepseek-v4-1-flash-1017-uncensored` |
+| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | none, required |
+| Model | `--model` | `SCAMSCRIPT_MODEL` | none, required |
 | State dir | `--home` | `SCAMSCRIPT_HOME` | `~/.scamscript` |
 
 ## Tests, CI and calibration
@@ -163,12 +167,12 @@ Calibration is evidence, not vibes. `scripts/calibrate.py` measures first-attemp
 adherence, repair rate, latency, score spread and billed cost against a live endpoint:
 
 ```bash
-API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
-  --model deepseek/deepseek-v4.1-flash-1017 \
-  --base-url https://openrouter.ai/api/v1
+API_KEY=... SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1 \
+  python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017
 ```
 
-Recorded passes with their numbers are in [`docs/calibration.md`](docs/calibration.md): three rubric
+Recorded passes with their numbers are in [`docs/calibration.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/calibration.md): three rubric
 repeats, a three-model comparison, an adversarial set and end-case stability runs. The current rubric
 reaches both ends of the scale, and quote checking flags the invented lines a plain reading would
 take as evidence.
@@ -176,7 +180,7 @@ take as evidence.
 The adversarial set lives in `examples/adversarial/` and has its own harness:
 
 ```bash
-API_KEY=... python scripts/injection_eval.py --model ... --base-url ...
+API_KEY=... SCAMSCRIPT_BASE_URL=... python scripts/injection_eval.py --model ...
 ```
 
 Format held in 7/7 cases; embedded demands were obeyed in 1 of 6. The fence protects the schema, not
@@ -218,5 +222,5 @@ docs/           calibration record, sample report, banner, demo
 For security research and fraud-awareness training only. Not legal advice, not an attribution
 tool, no warranty. Keep API keys out of commits; the key is read from the environment.
 
-MIT licensed, see [LICENSE](LICENSE). Contribution notes in [CONTRIBUTING.md](CONTRIBUTING.md),
+MIT licensed, see [LICENSE](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/LICENSE). Contribution notes in [CONTRIBUTING.md](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/CONTRIBUTING.md),
 vulnerability reports in [SECURITY.md](.github/SECURITY.md).

{scamscript-0.2.0 → scamscript-0.3.0}/pyproject.toml

@@ -4,11 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "scamscript"
-version = "0.2.0"
+version = "0.3.0"
 description = "Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks"
 readme = "README.md"
 requires-python = ">=3.12"
-license = { file = "LICENSE" }
+license = "MIT"
+license-files = ["LICENSE"]
 authors = [
   { name = "scamscript contributors", email = "313729361+sjdsjadjajdjsa@users.noreply.github.com" },
 ]

{scamscript-0.2.0 → scamscript-0.3.0}/scripts/calibrate.py

@@ -21,7 +21,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from scamscript.analysis import analyze_script  # noqa: E402
 from scamscript.client import ChatClient  # noqa: E402
-from scamscript.config import DEFAULT_BASE_URL, DEFAULT_MODEL, Settings  # noqa: E402
+from scamscript.config import Settings  # noqa: E402
 from scamscript.ingest import collect_scripts  # noqa: E402
 from scamscript.store import RunLogger  # noqa: E402
 
@@ -29,13 +29,15 @@ from scamscript.store import RunLogger  # noqa: E402
 def main(
     directory: Path = typer.Option(Path("examples"), "--dir", "-d"),
     repeat: int = typer.Option(2, "--repeat", "-n", min=1),
-    model: str = typer.Option(DEFAULT_MODEL, "--model", "-m"),
-    base_url: str = typer.Option(DEFAULT_BASE_URL, "--base-url"),
+    model: str = typer.Option("", "--model", "-m", envvar="SCAMSCRIPT_MODEL"),
+    base_url: str = typer.Option("", "--base-url", envvar="SCAMSCRIPT_BASE_URL"),
     prompt_price: float = typer.Option(0.035, help="USD per million prompt tokens."),
     completion_price: float = typer.Option(0.5, help="USD per million completion tokens."),
     max_tokens: int = typer.Option(4096, "--max-tokens"),
 ) -> None:
     settings = Settings(base_url=base_url, model=model, max_tokens=max_tokens)
+    settings.require_base_url()
+    settings.require_model()
     api_key = settings.require_api_key()
     scripts = collect_scripts(directory)
     runs = [script for _ in range(repeat) for script in scripts]

{scamscript-0.2.0 → scamscript-0.3.0}/scripts/injection_eval.py

@@ -22,7 +22,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from scamscript.analysis import analyze_script  # noqa: E402
 from scamscript.client import ChatClient  # noqa: E402
-from scamscript.config import DEFAULT_BASE_URL, DEFAULT_MODEL, Settings  # noqa: E402
+from scamscript.config import Settings  # noqa: E402
 from scamscript.ingest import ScriptFile  # noqa: E402
 from scamscript.store import RunLogger  # noqa: E402
 
@@ -82,10 +82,12 @@ CASES: dict[str, dict[str, object]] = {
 
 def main(
     directory: Path = typer.Option(Path("examples/adversarial"), "--dir", "-d"),
-    model: str = typer.Option(DEFAULT_MODEL, "--model", "-m"),
-    base_url: str = typer.Option(DEFAULT_BASE_URL, "--base-url"),
+    model: str = typer.Option("", "--model", "-m", envvar="SCAMSCRIPT_MODEL"),
+    base_url: str = typer.Option("", "--base-url", envvar="SCAMSCRIPT_BASE_URL"),
 ) -> None:
     settings = Settings(base_url=base_url, model=model)
+    settings.require_base_url()
+    settings.require_model()
     api_key = settings.require_api_key()
     cases = [(name, spec) for name, spec in CASES.items() if (directory / f"{name}.txt").is_file()]
 

{scamscript-0.2.0 → scamscript-0.3.0}/src/scamscript/__init__.py

@@ -1,3 +1,3 @@
 """scamscript: reverse-engineering analyzer for scam call scripts."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"

{scamscript-0.2.0 → scamscript-0.3.0}/src/scamscript/cli.py

@@ -15,9 +15,7 @@ from scamscript import report as reporting
 from scamscript.analysis import Outcome, analyze_script
 from scamscript.client import ChatClient
 from scamscript.config import (
-    DEFAULT_BASE_URL,
     DEFAULT_MAX_TOKENS,
-    DEFAULT_MODEL,
     DEFAULT_RETRIES,
     DEFAULT_TIMEOUT,
     ConfigError,
@@ -66,19 +64,17 @@ def version_callback(value: bool) -> None:
 def main(
     ctx: typer.Context,
     base_url: str = typer.Option(
-        DEFAULT_BASE_URL,
+        "",
         "--base-url",
         envvar="SCAMSCRIPT_BASE_URL",
-        help="OpenAI-compatible API base URL.",
-        show_default=True,
+        help="OpenAI-compatible API base URL. Falls back to SCAMSCRIPT_BASE_URL.",
     ),
     model: str = typer.Option(
-        DEFAULT_MODEL,
+        "",
         "--model",
         "-m",
         envvar="SCAMSCRIPT_MODEL",
-        help="Model identifier sent to the API.",
-        show_default=True,
+        help="Model identifier sent to the API. Falls back to SCAMSCRIPT_MODEL.",
     ),
     api_key: str | None = typer.Option(
         None,
@@ -219,6 +215,11 @@ def _run(
     )
 
     if state.dry_run:
+        if not settings.base_url or not settings.model:
+            console.print(
+                "[yellow]note[/yellow] --base-url and --model are unset; "
+                "the prompt below is complete but unaddressed"
+            )
         for script in scripts:
             text, counts = _maybe_redact(script.text, settings.redact)
             messages = prompts.build_messages(script.name, text)
@@ -246,6 +247,8 @@ def _run(
         return
 
     try:
+        settings.require_base_url()
+        settings.require_model()
         api_key = settings.require_api_key()
     except ConfigError as exc:
         _fail(console, str(exc))

{scamscript-0.2.0 → scamscript-0.3.0}/src/scamscript/client.py

@@ -8,9 +8,7 @@ from typing import Any, Callable
 import httpx
 
 from scamscript.config import (
-    DEFAULT_BASE_URL,
     DEFAULT_MAX_TOKENS,
-    DEFAULT_MODEL,
     DEFAULT_RETRIES,
     DEFAULT_TIMEOUT,
 )
@@ -42,8 +40,8 @@ class ChatClient:
     def __init__(
         self,
         api_key: str,
-        base_url: str = DEFAULT_BASE_URL,
-        model: str = DEFAULT_MODEL,
+        base_url: str = "",
+        model: str = "",
         timeout: float = DEFAULT_TIMEOUT,
         retries: int = DEFAULT_RETRIES,
         max_tokens: int = DEFAULT_MAX_TOKENS,
@@ -64,7 +62,7 @@ class ChatClient:
                 "Authorization": f"Bearer {api_key}",
                 "Content-Type": "application/json",
                 "Accept": "application/json",
-                "User-Agent": "scamscript/0.2",
+                "User-Agent": "scamscript/0.3.0",
             },
         )
 

{scamscript-0.2.0 → scamscript-0.3.0}/src/scamscript/config.py

@@ -5,8 +5,6 @@ from __future__ import annotations
 import os
 from dataclasses import dataclass, field
 
-DEFAULT_BASE_URL = "https://api.venice.ai/api/v1"
-DEFAULT_MODEL = "deepseek-v4-1-flash-1017-uncensored"
 DEFAULT_TIMEOUT = 120.0
 DEFAULT_RETRIES = 2
 DEFAULT_MAX_TOKENS = 4096
@@ -20,8 +18,8 @@ class ConfigError(Exception):
 
 @dataclass(slots=True)
 class Settings:
-    base_url: str = DEFAULT_BASE_URL
-    model: str = DEFAULT_MODEL
+    base_url: str = ""
+    model: str = ""
     api_key: str | None = None
     timeout: float = DEFAULT_TIMEOUT
     retries: int = DEFAULT_RETRIES
@@ -30,9 +28,8 @@ class Settings:
     home: str = field(default_factory=lambda: os.environ.get(ENV_HOME, ""))
 
     def __post_init__(self) -> None:
-        self.base_url = (self.base_url or DEFAULT_BASE_URL).rstrip("/")
-        if not self.model:
-            self.model = DEFAULT_MODEL
+        self.base_url = (self.base_url or "").strip().rstrip("/")
+        self.model = (self.model or "").strip()
         home = self.home or os.path.join(os.path.expanduser("~"), ".scamscript")
         self.home = home
 
@@ -42,6 +39,21 @@ class Settings:
             key = key.strip()
         return key or None
 
+    def require_base_url(self) -> str:
+        if not self.base_url:
+            raise ConfigError(
+                "missing API base URL: pass --base-url or set the SCAMSCRIPT_BASE_URL "
+                "environment variable"
+            )
+        return self.base_url
+
+    def require_model(self) -> str:
+        if not self.model:
+            raise ConfigError(
+                "missing model: pass --model or set the SCAMSCRIPT_MODEL environment variable"
+            )
+        return self.model
+
     def require_api_key(self) -> str:
         key = self.resolve_api_key()
         if key is None:

{scamscript-0.2.0 → scamscript-0.3.0}/tests/test_cli.py

@@ -50,6 +50,8 @@ class FakeClient:
 @pytest.fixture()
 def home(tmp_path, monkeypatch):
     monkeypatch.setenv("SCAMSCRIPT_HOME", str(tmp_path))
+    monkeypatch.setenv("SCAMSCRIPT_BASE_URL", "https://example.test/v1")
+    monkeypatch.setenv("SCAMSCRIPT_MODEL", "test-model")
     monkeypatch.delenv("API_KEY", raising=False)
     return tmp_path
 
@@ -194,10 +196,38 @@ def test_history_empty(home):
     assert "no runs logged" in result.stdout
 
 
+def test_missing_model(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_MODEL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    assert result.exit_code == 1
+    assert "missing model" in result.stdout
+
+
+def test_missing_base_url(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_BASE_URL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    assert result.exit_code == 1
+    assert "missing API base URL" in result.stdout
+
+
+def test_dry_run_without_endpoint(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_MODEL")
+    monkeypatch.delenv("SCAMSCRIPT_BASE_URL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--dry-run", "analyze", "--file", str(script)])
+    assert result.exit_code == 0
+    assert "unaddressed" in result.stdout
+
+
 def test_version(home):
     result = runner.invoke(cli.app, ["--version"])
     assert result.exit_code == 0
-    assert result.stdout.strip() == "scamscript 0.2.0"
+    assert result.stdout.strip() == "scamscript 0.3.0"
 
 
 def test_json_output_is_one_object_per_script(home, tmp_path, fake):