scamscript 0.2.1__tar.gz → 0.4.0__tar.gz

{scamscript-0.2.1 → scamscript-0.4.0}/CHANGELOG.md

@@ -5,6 +5,26 @@ schema are the things that count as public API.
 
 ## Unreleased
 
+## 0.4.0 - 2026-11-02
+
+### Added
+
+- `--concurrency N` (1-16) with order-preserving output.
+- `--max-cost USD`: stop scheduling once reported spend reaches the cap, mark the rest skipped, and
+  warn when a provider reports no cost.
+- Per-run reported spend in output and logs.
+
+### Changed
+
+- Token usage is tracked per thread so parallel calls cannot read each other's cost.
+
+## 0.3.0 - 2026-11-02
+
+### Changed
+
+- Breaking: no default provider or model. `--base-url` and `--model` (or `SCAMSCRIPT_BASE_URL` /
+  `SCAMSCRIPT_MODEL`) are required for API calls; `--dry-run` works without them.
+
 ## 0.2.1 - 2026-11-02
 
 ### Fixed

{scamscript-0.2.1 → scamscript-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scamscript
-Version: 0.2.1
+Version: 0.4.0
 Summary: Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/scamscript
 Project-URL: Repository, https://github.com/sjdsjadjajdjsa/scamscript
@@ -76,18 +76,22 @@ mechanics instead of general advice.
 pip install scamscript           # or, for development:
 # git clone https://github.com/sjdsjadjajdjsa/scamscript && cd scamscript && pip install -e ".[dev]"
 
-export API_KEY=...               # never committed, never logged
+export API_KEY=...
+export SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1
+export SCAMSCRIPT_MODEL=deepseek/deepseek-v4.1-flash-1017
 
 scamscript --dry-run analyze --file examples/tech_support_scam.txt   # inspect the prompt, spend nothing
 scamscript analyze --file examples/tech_support_scam.txt
 ```
 
-Any OpenAI-compatible `/chat/completions` endpoint works. Defaults are Venice with
-`deepseek-v4-1-flash-1017-uncensored`; OpenRouter needs only the model slug:
+Any OpenAI-compatible `/chat/completions` endpoint works. There is no baked-in provider or model:
+pass `--base-url` and `--model`, or set `SCAMSCRIPT_BASE_URL` and `SCAMSCRIPT_MODEL`.
 
 ```bash
 scamscript --base-url https://openrouter.ai/api/v1 \
   --model deepseek/deepseek-v4.1-flash-1017 analyze --file script.txt
+
+scamscript --base-url http://localhost:11434/v1 --model llama3.2 analyze --file script.txt
 ```
 
 ## What it produces
@@ -129,7 +133,7 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 | `prune` | Delete old logs |
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
-`--retries`, `--max-tokens`, `--no-color`. `--json` puts one object per script on stdout and all
+`--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -182,8 +186,8 @@ Release history is in [CHANGELOG.md](https://github.com/sjdsjadjajdjsa/scamscrip
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
 | API key | `--api-key` | `API_KEY` | none, required unless `--dry-run` |
-| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | `https://api.venice.ai/api/v1` |
-| Model | `--model` | `SCAMSCRIPT_MODEL` | `deepseek-v4-1-flash-1017-uncensored` |
+| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | none, required |
+| Model | `--model` | `SCAMSCRIPT_MODEL` | none, required |
 | State dir | `--home` | `SCAMSCRIPT_HOME` | `~/.scamscript` |
 
 ## Tests, CI and calibration
@@ -199,9 +203,9 @@ Calibration is evidence, not vibes. `scripts/calibrate.py` measures first-attemp
 adherence, repair rate, latency, score spread and billed cost against a live endpoint:
 
 ```bash
-API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
-  --model deepseek/deepseek-v4.1-flash-1017 \
-  --base-url https://openrouter.ai/api/v1
+API_KEY=... SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1 \
+  python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017
 ```
 
 Recorded passes with their numbers are in [`docs/calibration.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/calibration.md): three rubric
@@ -212,7 +216,7 @@ take as evidence.
 The adversarial set lives in `examples/adversarial/` and has its own harness:
 
 ```bash
-API_KEY=... python scripts/injection_eval.py --model ... --base-url ...
+API_KEY=... SCAMSCRIPT_BASE_URL=... python scripts/injection_eval.py --model ...
 ```
 
 Format held in 7/7 cases; embedded demands were obeyed in 1 of 6. The fence protects the schema, not
@@ -245,6 +249,7 @@ docs/           calibration record, sample report, banner, demo
   `opening_hook` and `red_flags` against the source before quoting anything.
 - Redaction is regex-based and will miss names and identifiers without a fixed shape.
 - One script per request; no cross-script deduplication yet, so reprints inflate a ranking.
+- The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
 - Analysis is English-centric: the prompt and schema assume English artifacts.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;
   an accurate paraphrase without quotes is skipped rather than judged.

{scamscript-0.2.1 → scamscript-0.4.0}/README.md

@@ -40,18 +40,22 @@ mechanics instead of general advice.
 pip install scamscript           # or, for development:
 # git clone https://github.com/sjdsjadjajdjsa/scamscript && cd scamscript && pip install -e ".[dev]"
 
-export API_KEY=...               # never committed, never logged
+export API_KEY=...
+export SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1
+export SCAMSCRIPT_MODEL=deepseek/deepseek-v4.1-flash-1017
 
 scamscript --dry-run analyze --file examples/tech_support_scam.txt   # inspect the prompt, spend nothing
 scamscript analyze --file examples/tech_support_scam.txt
 ```
 
-Any OpenAI-compatible `/chat/completions` endpoint works. Defaults are Venice with
-`deepseek-v4-1-flash-1017-uncensored`; OpenRouter needs only the model slug:
+Any OpenAI-compatible `/chat/completions` endpoint works. There is no baked-in provider or model:
+pass `--base-url` and `--model`, or set `SCAMSCRIPT_BASE_URL` and `SCAMSCRIPT_MODEL`.
 
 ```bash
 scamscript --base-url https://openrouter.ai/api/v1 \
   --model deepseek/deepseek-v4.1-flash-1017 analyze --file script.txt
+
+scamscript --base-url http://localhost:11434/v1 --model llama3.2 analyze --file script.txt
 ```
 
 ## What it produces
@@ -93,7 +97,7 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 | `prune` | Delete old logs |
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
-`--retries`, `--max-tokens`, `--no-color`. `--json` puts one object per script on stdout and all
+`--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -146,8 +150,8 @@ Release history is in [CHANGELOG.md](https://github.com/sjdsjadjajdjsa/scamscrip
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
 | API key | `--api-key` | `API_KEY` | none, required unless `--dry-run` |
-| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | `https://api.venice.ai/api/v1` |
-| Model | `--model` | `SCAMSCRIPT_MODEL` | `deepseek-v4-1-flash-1017-uncensored` |
+| Base URL | `--base-url` | `SCAMSCRIPT_BASE_URL` | none, required |
+| Model | `--model` | `SCAMSCRIPT_MODEL` | none, required |
 | State dir | `--home` | `SCAMSCRIPT_HOME` | `~/.scamscript` |
 
 ## Tests, CI and calibration
@@ -163,9 +167,9 @@ Calibration is evidence, not vibes. `scripts/calibrate.py` measures first-attemp
 adherence, repair rate, latency, score spread and billed cost against a live endpoint:
 
 ```bash
-API_KEY=... python scripts/calibrate.py --dir examples --repeat 3 \
-  --model deepseek/deepseek-v4.1-flash-1017 \
-  --base-url https://openrouter.ai/api/v1
+API_KEY=... SCAMSCRIPT_BASE_URL=https://openrouter.ai/api/v1 \
+  python scripts/calibrate.py --dir examples --repeat 3 \
+  --model deepseek/deepseek-v4.1-flash-1017
 ```
 
 Recorded passes with their numbers are in [`docs/calibration.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/calibration.md): three rubric
@@ -176,7 +180,7 @@ take as evidence.
 The adversarial set lives in `examples/adversarial/` and has its own harness:
 
 ```bash
-API_KEY=... python scripts/injection_eval.py --model ... --base-url ...
+API_KEY=... SCAMSCRIPT_BASE_URL=... python scripts/injection_eval.py --model ...
 ```
 
 Format held in 7/7 cases; embedded demands were obeyed in 1 of 6. The fence protects the schema, not
@@ -209,6 +213,7 @@ docs/           calibration record, sample report, banner, demo
   `opening_hook` and `red_flags` against the source before quoting anything.
 - Redaction is regex-based and will miss names and identifiers without a fixed shape.
 - One script per request; no cross-script deduplication yet, so reprints inflate a ranking.
+- The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
 - Analysis is English-centric: the prompt and schema assume English artifacts.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;
   an accurate paraphrase without quotes is skipped rather than judged.

{scamscript-0.2.1 → scamscript-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "scamscript"
-version = "0.2.1"
+version = "0.4.0"
 description = "Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks"
 readme = "README.md"
 requires-python = ">=3.12"

{scamscript-0.2.1 → scamscript-0.4.0}/scripts/calibrate.py

@@ -21,7 +21,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from scamscript.analysis import analyze_script  # noqa: E402
 from scamscript.client import ChatClient  # noqa: E402
-from scamscript.config import DEFAULT_BASE_URL, DEFAULT_MODEL, Settings  # noqa: E402
+from scamscript.config import Settings  # noqa: E402
 from scamscript.ingest import collect_scripts  # noqa: E402
 from scamscript.store import RunLogger  # noqa: E402
 
@@ -29,13 +29,15 @@ from scamscript.store import RunLogger  # noqa: E402
 def main(
     directory: Path = typer.Option(Path("examples"), "--dir", "-d"),
     repeat: int = typer.Option(2, "--repeat", "-n", min=1),
-    model: str = typer.Option(DEFAULT_MODEL, "--model", "-m"),
-    base_url: str = typer.Option(DEFAULT_BASE_URL, "--base-url"),
+    model: str = typer.Option("", "--model", "-m", envvar="SCAMSCRIPT_MODEL"),
+    base_url: str = typer.Option("", "--base-url", envvar="SCAMSCRIPT_BASE_URL"),
     prompt_price: float = typer.Option(0.035, help="USD per million prompt tokens."),
     completion_price: float = typer.Option(0.5, help="USD per million completion tokens."),
     max_tokens: int = typer.Option(4096, "--max-tokens"),
 ) -> None:
     settings = Settings(base_url=base_url, model=model, max_tokens=max_tokens)
+    settings.require_base_url()
+    settings.require_model()
     api_key = settings.require_api_key()
     scripts = collect_scripts(directory)
     runs = [script for _ in range(repeat) for script in scripts]

{scamscript-0.2.1 → scamscript-0.4.0}/scripts/injection_eval.py

@@ -22,7 +22,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
 
 from scamscript.analysis import analyze_script  # noqa: E402
 from scamscript.client import ChatClient  # noqa: E402
-from scamscript.config import DEFAULT_BASE_URL, DEFAULT_MODEL, Settings  # noqa: E402
+from scamscript.config import Settings  # noqa: E402
 from scamscript.ingest import ScriptFile  # noqa: E402
 from scamscript.store import RunLogger  # noqa: E402
 
@@ -82,10 +82,12 @@ CASES: dict[str, dict[str, object]] = {
 
 def main(
     directory: Path = typer.Option(Path("examples/adversarial"), "--dir", "-d"),
-    model: str = typer.Option(DEFAULT_MODEL, "--model", "-m"),
-    base_url: str = typer.Option(DEFAULT_BASE_URL, "--base-url"),
+    model: str = typer.Option("", "--model", "-m", envvar="SCAMSCRIPT_MODEL"),
+    base_url: str = typer.Option("", "--base-url", envvar="SCAMSCRIPT_BASE_URL"),
 ) -> None:
     settings = Settings(base_url=base_url, model=model)
+    settings.require_base_url()
+    settings.require_model()
     api_key = settings.require_api_key()
     cases = [(name, spec) for name, spec in CASES.items() if (directory / f"{name}.txt").is_file()]
 

{scamscript-0.2.1 → scamscript-0.4.0}/src/scamscript/__init__.py

@@ -1,3 +1,3 @@
 """scamscript: reverse-engineering analyzer for scam call scripts."""
 
-__version__ = "0.2.1"
+__version__ = "0.4.0"

{scamscript-0.2.1 → scamscript-0.4.0}/src/scamscript/analysis.py

@@ -26,6 +26,7 @@ class Outcome:
     error: str | None = None
     duration: float = 0.0
     redactions: dict[str, int] | None = None
+    skipped: bool = False
     issues: list[verify.Issue] | None = None
     verification: dict[str, int] | None = None
 
@@ -39,6 +40,7 @@ class Outcome:
             "source": str(self.source),
             "name": self.name,
             "ok": self.ok,
+            "skipped": self.skipped,
             "attempts": self.attempts,
             "duration_s": round(self.duration, 3),
             "breakdown": self.breakdown.model_dump() if self.breakdown else None,

{scamscript-0.2.1 → scamscript-0.4.0}/src/scamscript/cli.py

@@ -3,6 +3,8 @@
 from __future__ import annotations
 
 import json
+import threading
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -15,9 +17,7 @@ from scamscript import report as reporting
 from scamscript.analysis import Outcome, analyze_script
 from scamscript.client import ChatClient
 from scamscript.config import (
-    DEFAULT_BASE_URL,
     DEFAULT_MAX_TOKENS,
-    DEFAULT_MODEL,
     DEFAULT_RETRIES,
     DEFAULT_TIMEOUT,
     ConfigError,
@@ -66,19 +66,17 @@ def version_callback(value: bool) -> None:
 def main(
     ctx: typer.Context,
     base_url: str = typer.Option(
-        DEFAULT_BASE_URL,
+        "",
         "--base-url",
         envvar="SCAMSCRIPT_BASE_URL",
-        help="OpenAI-compatible API base URL.",
-        show_default=True,
+        help="OpenAI-compatible API base URL. Falls back to SCAMSCRIPT_BASE_URL.",
     ),
     model: str = typer.Option(
-        DEFAULT_MODEL,
+        "",
         "--model",
         "-m",
         envvar="SCAMSCRIPT_MODEL",
-        help="Model identifier sent to the API.",
-        show_default=True,
+        help="Model identifier sent to the API. Falls back to SCAMSCRIPT_MODEL.",
     ),
     api_key: str | None = typer.Option(
         None,
@@ -108,6 +106,20 @@ def main(
         min=256,
         help="Output token budget per reply.",
     ),
+    concurrency: int = typer.Option(
+        1,
+        "--concurrency",
+        "-j",
+        min=1,
+        max=16,
+        help="Analyze this many scripts in parallel.",
+    ),
+    max_cost: float | None = typer.Option(
+        None,
+        "--max-cost",
+        min=0.0,
+        help="Stop scheduling new scripts once the provider reports this much spend in USD.",
+    ),
     redact: bool = typer.Option(
         False,
         "--redact",
@@ -150,6 +162,8 @@ def main(
         timeout=timeout,
         retries=retries,
         max_tokens=max_tokens,
+        concurrency=concurrency,
+        max_cost=max_cost,
         redact=redact,
         home=str(home) if home else "",
     )
@@ -219,6 +233,11 @@ def _run(
     )
 
     if state.dry_run:
+        if not settings.base_url or not settings.model:
+            console.print(
+                "[yellow]note[/yellow] --base-url and --model are unset; "
+                "the prompt below is complete but unaddressed"
+            )
         for script in scripts:
             text, counts = _maybe_redact(script.text, settings.redact)
             messages = prompts.build_messages(script.name, text)
@@ -246,13 +265,19 @@ def _run(
         return
 
     try:
+        settings.require_base_url()
+        settings.require_model()
         api_key = settings.require_api_key()
     except ConfigError as exc:
         _fail(console, str(exc))
         return
 
-    outcomes: list[Outcome] = []
+    outcomes: list[Outcome | None] = [None] * len(scripts)
     report_entries: list[reporting.ReportEntry] = []
+    budget = settings.max_cost
+    spent = 0.0
+    spent_seen = False
+    lock = threading.Lock()
     client = ChatClient(
         api_key=api_key,
         base_url=settings.base_url,
@@ -261,50 +286,114 @@ def _run(
         retries=settings.retries,
         max_tokens=settings.max_tokens,
     )
-    with client:
-        for index, script in enumerate(scripts, start=1):
-            if batch_mode and not state.json_output:
-                console.print(
-                    f"[dim]({index}/{len(scripts)}) analyzing {script.name}...[/dim]"
+
+    def one(script: ScriptFile) -> Outcome:
+        nonlocal spent, spent_seen
+        if budget is not None:
+            with lock:
+                blocked = spent >= budget
+            if blocked:
+                outcome = Outcome(
+                    source=script.path,
+                    name=script.name,
+                    skipped=True,
+                    error="skipped: cost budget reached",
+                )
+                logger.result(**outcome.as_record())
+                return outcome
+        outcome = analyze_script(
+            client,
+            script,
+            logger,
+            redact_identifiers=settings.redact,
+            verify_quotes=state.verify_quotes,
+        )
+        cost = client.last_cost
+        if cost:
+            with lock:
+                spent += cost
+                spent_seen = True
+        return outcome
+
+    def emit(outcome: Outcome) -> None:
+        if state.json_output:
+            _emit_json(outcome.as_record())
+        elif outcome.skipped:
+            console.print(f"[dim]skipped {outcome.name}: budget reached[/dim]")
+        elif outcome.breakdown is not None:
+            console.print(
+                render_breakdown(
+                    outcome.breakdown, outcome.name, outcome.attempts, outcome.issues
                 )
-            outcome = analyze_script(
-                client,
-                script,
-                logger,
-                redact_identifiers=settings.redact,
-                verify_quotes=state.verify_quotes,
             )
-            outcomes.append(outcome)
-            report_entries.append(reporting.entry_from_outcome(outcome))
-            if state.json_output:
-                _emit_json(outcome.as_record())
-            elif outcome.breakdown is not None:
-                console.print(
-                    render_breakdown(
-                        outcome.breakdown,
-                        outcome.name,
-                        outcome.attempts,
-                        outcome.issues,
+        else:
+            console.print(
+                render_failure(outcome.name, outcome.error or "unknown", outcome.attempts)
+            )
+
+    with client:
+        if settings.concurrency == 1:
+            for index, script in enumerate(scripts, start=1):
+                if batch_mode and not state.json_output:
+                    console.print(
+                        f"[dim]({index}/{len(scripts)}) analyzing {script.name}...[/dim]"
                     )
-                )
-            else:
+                outcome = one(script)
+                outcomes[index - 1] = outcome
+                report_entries.append(reporting.entry_from_outcome(outcome))
+                emit(outcome)
+        else:
+            if not state.json_output:
                 console.print(
-                    render_failure(outcome.name, outcome.error or "unknown", outcome.attempts)
+                    f"[dim]analyzing {len(scripts)} script(s), "
+                    f"{settings.concurrency} at a time[/dim]"
                 )
-
-    successes = sum(1 for outcome in outcomes if outcome.ok)
-    failures = len(outcomes) - successes
+            buffered: dict[int, Outcome] = {}
+            ready = 0
+            with ThreadPoolExecutor(max_workers=settings.concurrency) as pool:
+                futures = {
+                    pool.submit(one, script): index for index, script in enumerate(scripts)
+                }
+                for future in as_completed(futures):
+                    buffered[futures[future]] = future.result()
+                    while ready in buffered:
+                        outcome = buffered.pop(ready)
+                        outcomes[ready] = outcome
+                        report_entries.append(reporting.entry_from_outcome(outcome))
+                        emit(outcome)
+                        ready += 1
+
+    finished = [outcome for outcome in outcomes if outcome is not None]
+    successes = sum(1 for outcome in finished if outcome.ok)
+    skipped = sum(1 for outcome in finished if outcome.skipped)
+    failures = len(finished) - successes - skipped
+    if budget is not None and not spent_seen:
+        console.print(
+            "[yellow]note[/yellow] the endpoint reported no cost; --max-cost could not be enforced"
+        )
+    if skipped:
+        console.print(f"[yellow]{skipped} script(s) skipped at the cost budget[/yellow]")
+    if spent:
+        console.print(f"[dim]reported spend: ${spent:.4f}[/dim]")
     unverified = sum(
-        1 for outcome in outcomes for issue in (outcome.issues or []) if not issue.ok
+        1 for outcome in finished for issue in (outcome.issues or []) if not issue.ok
     )
     if state.strict_quotes and unverified:
         failures += 0
-    logger.run_end(status="ok" if failures == 0 else "partial", results=successes, failures=failures)
+    logger.run_end(
+        status="ok" if failures == 0 else "partial",
+        results=successes,
+        failures=failures,
+        skipped=skipped,
+        cost_usd=round(spent, 6),
+    )
 
-    if batch_mode and successes:
+    if batch_mode and (successes or skipped):
         if not state.json_output:
             console.print(
-                render_summary_table([(o.name, o.breakdown, o.error) for o in outcomes])
+                render_summary_table(
+                    [(o.name, o.breakdown, o.error, o.skipped) for o in finished]
+                )
             )
         ranked = reporting.rank(report_entries)
         if top:

{scamscript-0.2.1 → scamscript-0.4.0}/src/scamscript/client.py

@@ -2,15 +2,14 @@
 
 from __future__ import annotations
 
+import threading
 import time
 from typing import Any, Callable
 
 import httpx
 
 from scamscript.config import (
-    DEFAULT_BASE_URL,
     DEFAULT_MAX_TOKENS,
-    DEFAULT_MODEL,
     DEFAULT_RETRIES,
     DEFAULT_TIMEOUT,
 )
@@ -42,8 +41,8 @@ class ChatClient:
     def __init__(
         self,
         api_key: str,
-        base_url: str = DEFAULT_BASE_URL,
-        model: str = DEFAULT_MODEL,
+        base_url: str = "",
+        model: str = "",
         timeout: float = DEFAULT_TIMEOUT,
         retries: int = DEFAULT_RETRIES,
         max_tokens: int = DEFAULT_MAX_TOKENS,
@@ -54,7 +53,7 @@ class ChatClient:
         self.model = model
         self.retries = max(0, retries)
         self.max_tokens = max_tokens
-        self.last_usage: dict[str, int] | None = None
+        self._usage = threading.local()
         self._sleep = sleep
         self._client = httpx.Client(
             base_url=self.base_url,
@@ -64,7 +63,7 @@ class ChatClient:
                 "Authorization": f"Bearer {api_key}",
                 "Content-Type": "application/json",
                 "Accept": "application/json",
-                "User-Agent": "scamscript/0.2.1",
+                "User-Agent": "scamscript/0.4.0",
             },
         )
 
@@ -77,6 +76,24 @@ class ChatClient:
     def close(self) -> None:
         self._client.close()
 
+    @property
+    def last_usage(self) -> dict[str, int] | None:
+        return getattr(self._usage, "value", None)
+
+    @last_usage.setter
+    def last_usage(self, value: dict[str, int] | None) -> None:
+        self._usage.value = value
+
+    @property
+    def last_cost(self) -> float | None:
+        usage = self.last_usage
+        if not usage:
+            return None
+        try:
+            return float(usage.get("cost") or 0.0)
+        except (TypeError, ValueError):
+            return None
+
     @property
     def endpoint(self) -> str:
         return f"{self.base_url}/chat/completions"

{scamscript-0.2.1 → scamscript-0.4.0}/src/scamscript/config.py

@@ -5,10 +5,9 @@ from __future__ import annotations
 import os
 from dataclasses import dataclass, field
 
-DEFAULT_BASE_URL = "https://api.venice.ai/api/v1"
-DEFAULT_MODEL = "deepseek-v4-1-flash-1017-uncensored"
 DEFAULT_TIMEOUT = 120.0
 DEFAULT_RETRIES = 2
+DEFAULT_CONCURRENCY = 1
 DEFAULT_MAX_TOKENS = 4096
 ENV_API_KEY = "API_KEY"
 ENV_HOME = "SCAMSCRIPT_HOME"
@@ -20,19 +19,23 @@ class ConfigError(Exception):
 
 @dataclass(slots=True)
 class Settings:
-    base_url: str = DEFAULT_BASE_URL
-    model: str = DEFAULT_MODEL
+    base_url: str = ""
+    model: str = ""
     api_key: str | None = None
     timeout: float = DEFAULT_TIMEOUT
     retries: int = DEFAULT_RETRIES
     max_tokens: int = DEFAULT_MAX_TOKENS
     redact: bool = False
+    concurrency: int = DEFAULT_CONCURRENCY
+    max_cost: float | None = None
     home: str = field(default_factory=lambda: os.environ.get(ENV_HOME, ""))
 
     def __post_init__(self) -> None:
-        self.base_url = (self.base_url or DEFAULT_BASE_URL).rstrip("/")
-        if not self.model:
-            self.model = DEFAULT_MODEL
+        self.base_url = (self.base_url or "").strip().rstrip("/")
+        self.model = (self.model or "").strip()
+        self.concurrency = max(1, min(16, self.concurrency))
+        if self.max_cost is not None:
+            self.max_cost = max(0.0, self.max_cost)
         home = self.home or os.path.join(os.path.expanduser("~"), ".scamscript")
         self.home = home
 
@@ -42,6 +45,21 @@ class Settings:
             key = key.strip()
         return key or None
 
+    def require_base_url(self) -> str:
+        if not self.base_url:
+            raise ConfigError(
+                "missing API base URL: pass --base-url or set the SCAMSCRIPT_BASE_URL "
+                "environment variable"
+            )
+        return self.base_url
+
+    def require_model(self) -> str:
+        if not self.model:
+            raise ConfigError(
+                "missing model: pass --model or set the SCAMSCRIPT_MODEL environment variable"
+            )
+        return self.model
+
     def require_api_key(self) -> str:
         key = self.resolve_api_key()
         if key is None:

{scamscript-0.2.1 → scamscript-0.4.0}/src/scamscript/render.py

@@ -207,14 +207,19 @@ def render_prompt(source: ScriptFile, messages: list[dict[str, str]]) -> Panel:
     )
 
 
-def render_summary_table(rows: list[tuple[str, ScriptBreakdown | None, str | None]]) -> Table:
+def render_summary_table(
+    rows: list[tuple[str, ScriptBreakdown | None, str | None, bool]]
+) -> Table:
     table = Table(title="Run summary", header_style="bold", expand=True)
     table.add_column("Script", overflow="fold", ratio=3)
     table.add_column("Attack type", ratio=2)
     table.add_column("Score", justify="right")
     table.add_column("Flags", justify="right")
     table.add_column("Status")
-    for name, breakdown, error in rows:
+    for name, breakdown, error, skipped in rows:
+        if skipped:
+            table.add_row(name, "-", "-", "-", "[yellow]skipped[/yellow]")
+            continue
         if breakdown is None:
             table.add_row(name, "-", "-", "-", f"[red]{error or 'failed'}[/red]")
             continue

{scamscript-0.2.1 → scamscript-0.4.0}/src/scamscript/report.py

@@ -29,6 +29,7 @@ class ReportEntry:
     breakdown: ScriptBreakdown | None = None
     error: str | None = None
     duration: float = 0.0
+    skipped: bool = False
     verification: dict[str, int] | None = None
     unverified: list[dict[str, str]] | None = None
 
@@ -42,6 +43,7 @@ def entry_from_outcome(outcome: Any) -> ReportEntry:
         name=outcome.name,
         source=str(getattr(outcome, "source", outcome.name)),
         breakdown=outcome.breakdown,
+        skipped=getattr(outcome, "skipped", False),
         error=outcome.error,
         duration=getattr(outcome, "duration", 0.0),
         verification=getattr(outcome, "verification", None),
@@ -68,6 +70,7 @@ def entries_from_run(run: dict[str, Any]) -> list[ReportEntry]:
                 name=record.get("name") or record.get("source") or "unknown",
                 source=record.get("source") or "",
                 breakdown=breakdown,
+                skipped=bool(record.get("skipped")),
                 error=None if breakdown else record.get("error") or "no breakdown stored",
                 duration=float(record.get("duration_s") or 0.0),
                 verification=record.get("verification") or None,
@@ -96,7 +99,8 @@ def build_markdown(
 ) -> str:
     ranked = rank(entries)
     ok = [entry for entry in ranked if entry.ok]
-    failed = [entry for entry in ranked if not entry.ok]
+    skipped = [entry for entry in ranked if entry.skipped and not entry.ok]
+    failed = [entry for entry in ranked if not entry.ok and not entry.skipped]
     average = (
         sum(entry.breakdown.sophistication_score for entry in ok) / len(ok) if ok else 0.0
     )
@@ -112,6 +116,8 @@ def build_markdown(
     lines.append(f"- Scripts analyzed: {len(entries)}")
     lines.append(f"- Successful: {len(ok)}")
     lines.append(f"- Failed: {len(failed)}")
+    if skipped:
+        lines.append(f"- Skipped at budget: {len(skipped)}")
     unverified_total = sum(len(entry.unverified or []) for entry in ok)
     if unverified_total:
         lines.append(f"- Unverified quotes: {unverified_total}")
@@ -137,6 +143,13 @@ def build_markdown(
         lines.append("_No successful analyses in this run._")
         lines.append("")
 
+    if skipped:
+        lines.append("## Skipped")
+        lines.append("")
+        for entry in skipped:
+            lines.append(f"- **{_cell(entry.name)}** (`{_cell(entry.source)}`)")
+        lines.append("")
+
     if failed:
         lines.append("## Failures")
         lines.append("")

{scamscript-0.2.1 → scamscript-0.4.0}/tests/test_cli.py

@@ -32,6 +32,7 @@ class FakeClient:
         self.base_url = base_url
         self.model = model
         self.max_tokens = kwargs.get("max_tokens", 4096)
+        self.last_cost = None
 
     def __enter__(self):
         return self
@@ -50,6 +51,8 @@ class FakeClient:
 @pytest.fixture()
 def home(tmp_path, monkeypatch):
     monkeypatch.setenv("SCAMSCRIPT_HOME", str(tmp_path))
+    monkeypatch.setenv("SCAMSCRIPT_BASE_URL", "https://example.test/v1")
+    monkeypatch.setenv("SCAMSCRIPT_MODEL", "test-model")
     monkeypatch.delenv("API_KEY", raising=False)
     return tmp_path
 
@@ -194,10 +197,38 @@ def test_history_empty(home):
     assert "no runs logged" in result.stdout
 
 
+def test_missing_model(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_MODEL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    assert result.exit_code == 1
+    assert "missing model" in result.stdout
+
+
+def test_missing_base_url(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_BASE_URL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    assert result.exit_code == 1
+    assert "missing API base URL" in result.stdout
+
+
+def test_dry_run_without_endpoint(home, tmp_path, monkeypatch):
+    monkeypatch.delenv("SCAMSCRIPT_MODEL")
+    monkeypatch.delenv("SCAMSCRIPT_BASE_URL")
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: hello", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--dry-run", "analyze", "--file", str(script)])
+    assert result.exit_code == 0
+    assert "unaddressed" in result.stdout
+
+
 def test_version(home):
     result = runner.invoke(cli.app, ["--version"])
     assert result.exit_code == 0
-    assert result.stdout.strip() == "scamscript 0.2.1"
+    assert result.stdout.strip() == "scamscript 0.4.0"
 
 
 def test_json_output_is_one_object_per_script(home, tmp_path, fake):
@@ -311,3 +342,70 @@ def test_json_result_carries_verification(home, tmp_path, fake):
     record = json.loads(result.stdout.splitlines()[0])
     assert record["verification"] == {"checked": 1, "verbatim": 0, "close": 0, "missing": 1}
     assert record["unverified"][0]["status"] == "missing"
+
+
+def test_concurrency_keeps_output_order(home, tmp_path, fake):
+    for index in range(6):
+        (tmp_path / f"s{index}.txt").write_text(f"CALLER: script {index}", encoding="utf-8")
+    result = runner.invoke(
+        cli.app, ["--api-key", "k", "--json", "--concurrency", "4", "batch", str(tmp_path)]
+    )
+    assert result.exit_code == 0
+    records = [json.loads(line) for line in result.stdout.splitlines() if line.strip()]
+    names = [record["name"] for record in records if "name" in record]
+    assert names[:6] == [f"s{i}.txt" for i in range(6)]
+
+
+def test_concurrency_runs_in_parallel(home, tmp_path, fake, monkeypatch):
+    import threading, time
+
+    active = {"now": 0, "peak": 0}
+    lock = threading.Lock()
+
+    def complete(self, messages, **kwargs):
+        with lock:
+            active["now"] += 1
+            active["peak"] = max(active["peak"], active["now"])
+        time.sleep(0.05)
+        with lock:
+            active["now"] -= 1
+        return json.dumps(breakdown())
+
+    monkeypatch.setattr(FakeClient, "complete", complete)
+    for index in range(6):
+        (tmp_path / f"s{index}.txt").write_text("CALLER: x", encoding="utf-8")
+
+    result = runner.invoke(
+        cli.app, ["--api-key", "k", "--concurrency", "4", "batch", str(tmp_path)]
+    )
+    assert result.exit_code == 0
+    assert active["peak"] > 1
+
+
+def test_max_cost_skips_remaining(home, tmp_path, fake, monkeypatch):
+    for index in range(4):
+        (tmp_path / f"s{index}.txt").write_text("CALLER: x", encoding="utf-8")
+
+    def complete(self, messages, **kwargs):
+        self.last_cost = 0.01
+        return json.dumps(breakdown())
+
+    monkeypatch.setattr(FakeClient, "complete", complete)
+    out = tmp_path / "r.md"
+    result = runner.invoke(
+        cli.app,
+        ["--api-key", "k", "--max-cost", "0.015", "batch", str(tmp_path), "--output", str(out)],
+    )
+    assert "skipped at the cost budget" in result.stdout
+    markdown = out.read_text()
+    assert "Skipped at budget" in markdown
+    assert "## Skipped" in markdown
+
+
+def test_max_cost_warns_when_provider_reports_nothing(home, tmp_path, fake):
+    (tmp_path / "a.txt").write_text("CALLER: x", encoding="utf-8")
+    result = runner.invoke(
+        cli.app, ["--api-key", "k", "--max-cost", "0.5", "analyze", "--file", str(tmp_path / "a.txt")]
+    )
+    assert result.exit_code == 0
+    assert "could not be enforced" in result.stdout

{scamscript-0.2.1 → scamscript-0.4.0}/tests/test_client.py

@@ -276,3 +276,36 @@ def test_length_with_only_reasoning_is_truncation():
         with pytest.raises(TruncatedError) as excinfo:
             client.complete(MESSAGES)
     assert excinfo.value.partial == "thinking..."
+
+
+def test_usage_is_thread_local():
+    import threading
+
+    def handler(request):
+        content = json.loads(request.read())["messages"][-1]["content"]
+        return httpx.Response(
+            200,
+            json={
+                "choices": [{"message": {"content": content}}],
+                "usage": {"prompt_tokens": 1, "completion_tokens": 1, "cost": float(len(content))},
+            },
+        )
+
+    client = ChatClient(
+        api_key="k",
+        base_url="https://example.test/v1",
+        transport=httpx.MockTransport(handler),
+    )
+    seen = {}
+
+    def run(role, text):
+        client.complete([{"role": role, "content": text}])
+        seen[role] = client.last_cost
+
+    threads = [threading.Thread(target=run, args=("a", "xx")), threading.Thread(target=run, args=("b", "xxxx"))]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join()
+    client.close()
+    assert seen == {"a": 2.0, "b": 4.0}

{scamscript-0.2.1 → scamscript-0.4.0}/tests/test_render.py

@@ -76,9 +76,14 @@ def test_prompt_panel():
 
 
 def test_summary_table_row_states():
-    text = capture(render_summary_table([("ok.txt", breakdown(), None), ("bad.txt", None, "boom")]))
+    text = capture(
+        render_summary_table(
+            [("ok.txt", breakdown(), None, False), ("bad.txt", None, "boom", False), ("skip.txt", None, "skipped", True)]
+        )
+    )
     assert "ok.txt" in text
     assert "boom" in text
+    assert "skipped" in text
 
 
 def test_panel_shows_quote_check():