scamscript 0.2.1__tar.gz → 0.3.0__tar.gz

{scamscript-0.2.1 → scamscript-0.3.0}/CHANGELOG.md

@@ -5,6 +5,13 @@ schema are the things that count as public API.
 
 ## Unreleased
 
+## 0.3.0 - 2026-11-02
+
+### Changed
+
+- Breaking: no default provider or model. `--base-url` and `--model` (or `SCAMSCRIPT_BASE_URL` /
+  `SCAMSCRIPT_MODEL`) are required for API calls; `--dry-run` works without them.
+
 ## 0.2.1 - 2026-11-02
 
 ### Fixed

{scamscript-0.2.1 → scamscript-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scamscript
-Version: 0.2.1
+Version: 0.3.0
 Summary: Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/scamscript
 Project-URL: Repository, https://github.com/sjdsjadjajdjsa/scamscript
@@ -76,18 +76,22 @@ mechanics instead of general advice.
 pip install scamscript           # or, for development:
 # git clone https://github.com/sjdsjadjajdjsa/scamscript && cd scamscript && pip install -e ".[dev]"
 
-export API_KEY=...               # never committed, never logged
+export API_KEY=...
+export SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1
+export SCAMSCRIPT_MODEL=deepseek/deepseek-v4.1-flash-1017
 
 scamscript --dry-run analyze --file examples/tech_support_scam.txt   # inspect the prompt, spend nothing
 scamscript analyze --file examples/tech_support_scam.txt
 ```
 
-Any OpenAI-compatible `/chat/completions` endpoint works. Defaults are Venice with
-`deepseek-v4-1-flash-1017-uncensored`; OpenRouter needs only the model slug:
+Any OpenAI-compatible `/chat/completions` endpoint works. There is no baked-in provider or model:
+pass `--base-url` and `--model`, or set `SCAMSCRIPT_BASE_URL` and `SCAMSCRIPT_MODEL`.
 
 ```bash
 scamscript --base-url https://openrouter.ai/api/v1 \
   --model deepseek/deepseek-v4.1-flash-1017 analyze --file script.txt
+
+scamscript --base-url http://localhost:11434/v1 --model llama3.2 analyze --file script.txt
 ```
 
 ## What it produces
@@ -182,8 +186,8 @@ Release history is in [CHANGELOG.md](https://github.com/sjdsjadjajdjsa/scamscrip
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
 | API key | `--api-key` | `API_KEY` | none, required unless `--dry-run` |
-| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | `https://api.venice.ai/api/v1` |
-| Model | `--model` | `SCAMSCRIPT_MODEL` | `deepseek-v4-1-flash-1017-uncensored` |
+| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | none, required |
+| Model | `--model` | `SCAMSCRIPT_MODEL` | none, required |
 | State dir | `--home` | `SCAMSCRIPT_HOME` | `~/.scamscript` |
 
 ## Tests, CI and calibration
@@ -199,9 +203,9 @@ Calibration is evidence, not vibes. `scripts/calibrate.py` measures first-attemp
 adherence, repair rate, latency, score spread and billed cost against a live endpoint:
 
 ```bash
-API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
-  --model deepseek/deepseek-v4.1-flash-1017 \
-  --base-url https://openrouter.ai/api/v1
+API_KEY=... SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1 \
+  python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017
 ```
 
 Recorded passes with their numbers are in [`docs/calibration.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/calibration.md): three rubric
@@ -212,7 +216,7 @@ take as evidence.
 The adversarial set lives in `examples/adversarial/` and has its own harness:
 
 ```bash
-API_KEY=... python scripts/injection_eval.py --model ... --base-url ...
+API_KEY=... SCAMSCRIPT_BASE_URL=... python scripts/injection_eval.py --model ...
 ```
 
 Format held in 7/7 cases; embedded demands were obeyed in 1 of 6. The fence protects the schema, not

{scamscript-0.2.1 → scamscript-0.3.0}/README.md

@@ -40,18 +40,22 @@ mechanics instead of general advice.
 pip install scamscript           # or, for development:
 # git clone https://github.com/sjdsjadjajdjsa/scamscript && cd scamscript && pip install -e ".[dev]"
 
-export API_KEY=...               # never committed, never logged
+export API_KEY=...
+export SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1
+export SCAMSCRIPT_MODEL=deepseek/deepseek-v4.1-flash-1017
 
 scamscript --dry-run analyze --file examples/tech_support_scam.txt   # inspect the prompt, spend nothing
 scamscript analyze --file examples/tech_support_scam.txt
 ```
 
-Any OpenAI-compatible `/chat/completions` endpoint works. Defaults are Venice with
-`deepseek-v4-1-flash-1017-uncensored`; OpenRouter needs only the model slug:
+Any OpenAI-compatible `/chat/completions` endpoint works. There is no baked-in provider or model:
+pass `--base-url` and `--model`, or set `SCAMSCRIPT_BASE_URL` and `SCAMSCRIPT_MODEL`.
 
 ```bash
 scamscript --base-url https://openrouter.ai/api/v1 \
   --model deepseek/deepseek-v4.1-flash-1017 analyze --file script.txt
+
+scamscript --base-url http://localhost:11434/v1 --model llama3.2 analyze --file script.txt
 ```
 
 ## What it produces
@@ -146,8 +150,8 @@ Release history is in [CHANGELOG.md](https://github.com/sjdsjadjajdjsa/scamscrip
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
 | API key | `--api-key` | `API_KEY` | none, required unless `--dry-run` |
-| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | `https://api.venice.ai/api/v1` |
-| Model | `--model` | `SCAMSCRIPT_MODEL` | `deepseek-v4-1-flash-1017-uncensored` |
+| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | none, required |
+| Model | `--model` | `SCAMSCRIPT_MODEL` | none, required |
 | State dir | `--home` | `SCAMSCRIPT_HOME` | `~/.scamscript` |
 
 ## Tests, CI and calibration
@@ -163,9 +167,9 @@ Calibration is evidence, not vibes. `scripts/calibrate.py` measures first-attemp
 adherence, repair rate, latency, score spread and billed cost against a live endpoint:
 
 ```bash
-API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
-  --model deepseek/deepseek-v4.1-flash-1017 \
-  --base-url https://openrouter.ai/api/v1
+API_KEY=... SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1 \
+  python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017
 ```
 
 Recorded passes with their numbers are in [`docs/calibration.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/calibration.md): three rubric
@@ -176,7 +180,7 @@ take as evidence.
 The adversarial set lives in `examples/adversarial/` and has its own harness:
 
 ```bash
-API_KEY=... python scripts/injection_eval.py --model ... --base-url ...
+API_KEY=... SCAMSCRIPT_BASE_URL=... python scripts/injection_eval.py --model ...
 ```
 
 Format held in 7/7 cases; embedded demands were obeyed in 1 of 6. The fence protects the schema, not

{scamscript-0.2.1 → scamscript-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "scamscript"
-version = "0.2.1"
+version = "0.3.0"
 description = "Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks"
 readme = "README.md"
 requires-python = ">=3.12"

{scamscript-0.2.1 → scamscript-0.3.0}/scripts/calibrate.py

@@ -21,7 +21,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from scamscript.analysis import analyze_script  # noqa: E402
 from scamscript.client import ChatClient  # noqa: E402
-from scamscript.config import DEFAULT_BASE_URL, DEFAULT_MODEL, Settings  # noqa: E402
+from scamscript.config import Settings  # noqa: E402
 from scamscript.ingest import collect_scripts  # noqa: E402
 from scamscript.store import RunLogger  # noqa: E402
 
@@ -29,13 +29,15 @@ from scamscript.store import RunLogger  # noqa: E402
 def main(
     directory: Path = typer.Option(Path("examples"), "--dir", "-d"),
     repeat: int = typer.Option(2, "--repeat", "-n", min=1),
-    model: str = typer.Option(DEFAULT_MODEL, "--model", "-m"),
-    base_url: str = typer.Option(DEFAULT_BASE_URL, "--base-url"),
+    model: str = typer.Option("", "--model", "-m", envvar="SCAMSCRIPT_MODEL"),
+    base_url: str = typer.Option("", "--base-url", envvar="SCAMSCRIPT_BASE_URL"),
     prompt_price: float = typer.Option(0.035, help="USD per million prompt tokens."),
     completion_price: float = typer.Option(0.5, help="USD per million completion tokens."),
     max_tokens: int = typer.Option(4096, "--max-tokens"),
 ) -> None:
     settings = Settings(base_url=base_url, model=model, max_tokens=max_tokens)
+    settings.require_base_url()
+    settings.require_model()
     api_key = settings.require_api_key()
     scripts = collect_scripts(directory)
     runs = [script for _ in range(repeat) for script in scripts]

{scamscript-0.2.1 → scamscript-0.3.0}/scripts/injection_eval.py

@@ -22,7 +22,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from scamscript.analysis import analyze_script  # noqa: E402
 from scamscript.client import ChatClient  # noqa: E402
-from scamscript.config import DEFAULT_BASE_URL, DEFAULT_MODEL, Settings  # noqa: E402
+from scamscript.config import Settings  # noqa: E402
 from scamscript.ingest import ScriptFile  # noqa: E402
 from scamscript.store import RunLogger  # noqa: E402
 
@@ -82,10 +82,12 @@ CASES: dict[str, dict[str, object]] = {
 
 def main(
     directory: Path = typer.Option(Path("examples/adversarial"), "--dir", "-d"),
-    model: str = typer.Option(DEFAULT_MODEL, "--model", "-m"),
-    base_url: str = typer.Option(DEFAULT_BASE_URL, "--base-url"),
+    model: str = typer.Option("", "--model", "-m", envvar="SCAMSCRIPT_MODEL"),
+    base_url: str = typer.Option("", "--base-url", envvar="SCAMSCRIPT_BASE_URL"),
 ) -> None:
     settings = Settings(base_url=base_url, model=model)
+    settings.require_base_url()
+    settings.require_model()
     api_key = settings.require_api_key()
     cases = [(name, spec) for name, spec in CASES.items() if (directory / f"{name}.txt").is_file()]
 

{scamscript-0.2.1 → scamscript-0.3.0}/src/scamscript/__init__.py

@@ -1,3 +1,3 @@
 """scamscript: reverse-engineering analyzer for scam call scripts."""
 
-__version__ = "0.2.1"
+__version__ = "0.3.0"

{scamscript-0.2.1 → scamscript-0.3.0}/src/scamscript/cli.py

@@ -15,9 +15,7 @@ from scamscript import report as reporting
 from scamscript.analysis import Outcome, analyze_script
 from scamscript.client import ChatClient
 from scamscript.config import (
-    DEFAULT_BASE_URL,
     DEFAULT_MAX_TOKENS,
-    DEFAULT_MODEL,
     DEFAULT_RETRIES,
     DEFAULT_TIMEOUT,
     ConfigError,
@@ -66,19 +64,17 @@ def version_callback(value: bool) -> None:
 def main(
     ctx: typer.Context,
     base_url: str = typer.Option(
-        DEFAULT_BASE_URL,
+        "",
         "--base-url",
         envvar="SCAMSCRIPT_BASE_URL",
-        help="OpenAI-compatible API base URL.",
-        show_default=True,
+        help="OpenAI-compatible API base URL. Falls back to SCAMSCRIPT_BASE_URL.",
     ),
     model: str = typer.Option(
-        DEFAULT_MODEL,
+        "",
         "--model",
         "-m",
         envvar="SCAMSCRIPT_MODEL",
-        help="Model identifier sent to the API.",
-        show_default=True,
+        help="Model identifier sent to the API. Falls back to SCAMSCRIPT_MODEL.",
     ),
     api_key: str | None = typer.Option(
         None,
@@ -219,6 +215,11 @@ def _run(
     )
 
     if state.dry_run:
+        if not settings.base_url or not settings.model:
+            console.print(
+                "[yellow]note[/yellow] --base-url and --model are unset; "
+                "the prompt below is complete but unaddressed"
+            )
         for script in scripts:
             text, counts = _maybe_redact(script.text, settings.redact)
             messages = prompts.build_messages(script.name, text)
@@ -246,6 +247,8 @@ def _run(
         return
 
     try:
+        settings.require_base_url()
+        settings.require_model()
         api_key = settings.require_api_key()
     except ConfigError as exc:
         _fail(console, str(exc))

{scamscript-0.2.1 → scamscript-0.3.0}/src/scamscript/client.py

@@ -8,9 +8,7 @@ from typing import Any, Callable
 import httpx
 
 from scamscript.config import (
-    DEFAULT_BASE_URL,
     DEFAULT_MAX_TOKENS,
-    DEFAULT_MODEL,
     DEFAULT_RETRIES,
     DEFAULT_TIMEOUT,
 )
@@ -42,8 +40,8 @@ class ChatClient:
     def __init__(
         self,
         api_key: str,
-        base_url: str = DEFAULT_BASE_URL,
-        model: str = DEFAULT_MODEL,
+        base_url: str = "",
+        model: str = "",
         timeout: float = DEFAULT_TIMEOUT,
         retries: int = DEFAULT_RETRIES,
         max_tokens: int = DEFAULT_MAX_TOKENS,
@@ -64,7 +62,7 @@ class ChatClient:
                 "Authorization": f"Bearer {api_key}",
                 "Content-Type": "application/json",
                 "Accept": "application/json",
-                "User-Agent": "scamscript/0.2.1",
+                "User-Agent": "scamscript/0.3.0",
             },
         )
 

{scamscript-0.2.1 → scamscript-0.3.0}/src/scamscript/config.py

@@ -5,8 +5,6 @@ from __future__ import annotations
 import os
 from dataclasses import dataclass, field
 
-DEFAULT_BASE_URL = "https://api.venice.ai/api/v1"
-DEFAULT_MODEL = "deepseek-v4-1-flash-1017-uncensored"
 DEFAULT_TIMEOUT = 120.0
 DEFAULT_RETRIES = 2
 DEFAULT_MAX_TOKENS = 4096
@@ -20,8 +18,8 @@ class ConfigError(Exception):
 
 @dataclass(slots=True)
 class Settings:
-    base_url: str = DEFAULT_BASE_URL
-    model: str = DEFAULT_MODEL
+    base_url: str = ""
+    model: str = ""
     api_key: str | None = None
     timeout: float = DEFAULT_TIMEOUT
     retries: int = DEFAULT_RETRIES
@@ -30,9 +28,8 @@ class Settings:
     home: str = field(default_factory=lambda: os.environ.get(ENV_HOME, ""))
 
     def __post_init__(self) -> None:
-        self.base_url = (self.base_url or DEFAULT_BASE_URL).rstrip("/")
-        if not self.model:
-            self.model = DEFAULT_MODEL
+        self.base_url = (self.base_url or "").strip().rstrip("/")
+        self.model = (self.model or "").strip()
         home = self.home or os.path.join(os.path.expanduser("~"), ".scamscript")
         self.home = home
 
@@ -42,6 +39,21 @@ class Settings:
             key = key.strip()
         return key or None
 
+    def require_base_url(self) -> str:
+        if not self.base_url:
+            raise ConfigError(
+                "missing API base URL: pass --base-url or set the SCAMSCRIPT_BASE_URL "
+                "environment variable"
+            )
+        return self.base_url
+
+    def require_model(self) -> str:
+        if not self.model:
+            raise ConfigError(
+                "missing model: pass --model or set the SCAMSCRIPT_MODEL environment variable"
+            )
+        return self.model
+
     def require_api_key(self) -> str:
         key = self.resolve_api_key()
         if key is None:

{scamscript-0.2.1 → scamscript-0.3.0}/tests/test_cli.py

@@ -50,6 +50,8 @@ class FakeClient:
 @pytest.fixture()
 def home(tmp_path, monkeypatch):
     monkeypatch.setenv("SCAMSCRIPT_HOME", str(tmp_path))
+    monkeypatch.setenv("SCAMSCRIPT_BASE_URL", "https://example.test/v1")
+    monkeypatch.setenv("SCAMSCRIPT_MODEL", "test-model")
     monkeypatch.delenv("API_KEY", raising=False)
     return tmp_path
 
@@ -194,10 +196,38 @@ def test_history_empty(home):
     assert "no runs logged" in result.stdout
 
 
+def test_missing_model(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_MODEL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    assert result.exit_code == 1
+    assert "missing model" in result.stdout
+
+
+def test_missing_base_url(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_BASE_URL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    assert result.exit_code == 1
+    assert "missing API base URL" in result.stdout
+
+
+def test_dry_run_without_endpoint(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_MODEL")
+    monkeypatch.delenv("SCAMSCRIPT_BASE_URL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--dry-run", "analyze", "--file", str(script)])
+    assert result.exit_code == 0
+    assert "unaddressed" in result.stdout
+
+
 def test_version(home):
     result = runner.invoke(cli.app, ["--version"])
     assert result.exit_code == 0
-    assert result.stdout.strip() == "scamscript 0.2.1"
+    assert result.stdout.strip() == "scamscript 0.3.0"
 
 
 def test_json_output_is_one_object_per_script(home, tmp_path, fake):