scamscript 0.6.0__tar.gz → 0.7.0__tar.gz

{scamscript-0.6.0 → scamscript-0.7.0}/.github/workflows/release.yml

@@ -4,12 +4,6 @@ on:
   push:
     tags: ["v*"]
   workflow_dispatch:
-    inputs:
-      repository:
-        description: Target index
-        type: choice
-        options: [pypi, testpypi]
-        default: testpypi
 
 permissions:
   contents: read
@@ -38,25 +32,8 @@ jobs:
           name: dist
           path: dist/
 
-  testpypi:
-    needs: build
-    if: github.event_name == 'workflow_dispatch' && inputs.repository == 'testpypi'
-    runs-on: ubuntu-latest
-    environment: testpypi
-    permissions:
-      id-token: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: dist
-          path: dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          repository-url: https://test.pypi.org/legacy/
-
   pypi:
     needs: build
-    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.repository == 'pypi')
     runs-on: ubuntu-latest
     environment: pypi
     permissions:

{scamscript-0.6.0 → scamscript-0.7.0}/CHANGELOG.md

@@ -5,6 +5,33 @@ schema are the things that count as public API.
 
 ## Unreleased
 
+## 0.7.0 - 2026-11-02
+
+### Added
+
+- `brief` command: a one-page defence handout per type from a finished run.
+- `--language` override and stopword language detection; the prompt asks for the script's own language.
+- `corpus/real/` with ten published transcripts, provenance in every header, and `docs/real-corpus.md`.
+- `--force` before overwriting an output file.
+
+### Fixed
+
+- Apostrophes inside words (`target's`) were read as quote delimiters, producing false `missing`
+  verdicts. Long quotes are now checked clause by clause.
+- A recursive walk followed a symlink loop; it now terminates.
+- A file changing mid-read is reported instead of being half-analyzed.
+- Utility-rebate robocalls classified as `refund`; utility is matched first.
+
+### Changed
+
+- Default `--max-tokens` 4096 → 6144, after two real calls hit the ceiling on the first attempt.
+
+## 0.6.1 - 2026-11-02
+
+### Changed
+
+- Removed the unused TestPyPI job and environment. Manual dispatch publishes to PyPI directly.
+
 ## 0.6.0 - 2026-11-02
 
 ### Added

{scamscript-0.6.0 → scamscript-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scamscript
-Version: 0.6.0
+Version: 0.7.0
 Summary: Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/scamscript
 Project-URL: Repository, https://github.com/sjdsjadjajdjsa/scamscript
@@ -130,11 +130,12 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 | `batch <dir>` | Same as above, ranked |
 | `report --run-id` | Regenerate a report from a past run's log |
 | `history` | List previous runs |
+| `brief` | One-page defence handout from a finished run |
 | `prune` | Delete old logs |
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
 `--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--dedupe/--no-dedupe`,
-`--show-duplicates`, `--type`, `--no-color`. `--json` puts one object per script on stdout and all
+`--show-duplicates`, `--type`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -155,6 +156,17 @@ The cap reads `usage.cost` from the response, so it works only where the provide
 says so when none is sent. Spend is printed and logged per run. In-flight requests can overshoot by
 up to the concurrency, so keep headroom on a hard limit.
 
+## Real corpus
+
+`corpus/real/` holds ten published transcripts with source, date and verbatim status in every
+header: a 40-minute bank impersonation call, a Medicare benefits pitch, six FTC robocalls, a
+recalled credit-union call and a USPS smishing message. Provenance and the results of running them
+are in [`docs/real-corpus.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/real-corpus.md).
+
+```bash
+scamscript --redact batch corpus/real --concurrency 3 --max-cost 0.25 --output real.md
+```
+
 ## Attack types
 
 `attack_type` is free prose, which is useful to read and useless to group. Every result also carries a
@@ -166,6 +178,12 @@ per slug above the ranking, and `--type` filters to the ones you ask for:
 scamscript batch corpus/ --type tech-support,refund --output report.md
 ```
 
+Briefings group the same way. Build one from a finished run:
+
+```bash
+scamscript brief --type tech-support --output briefing.md
+```
+
 The raw phrase is always kept next to the slug. An unrecognised description lands in `other` and the
 CLI names any filter token it did not recognise.
 
@@ -220,6 +238,12 @@ Every request appends to a timestamped JSONL file under `~/.scamscript/logs/` (o
 a run replays without spending tokens, and `prune --keep 200 --keep-days 30` keeps the store
 bounded. Directories are `0700` and log files `0600`.
 
+## Paths
+
+`--file` and `--dir` resolve symlinks, a recursive walk survives a symlink loop, and a file that
+changes while it is read is an error rather than a half-read prompt. Output files are not overwritten
+unless `--force` is passed.
+
 ## Install and configure
 
 Python 3.12+. `pip install scamscript` for use, `pip install -e ".[dev]"` from a clone for tests.
@@ -281,6 +305,7 @@ src/scamscript/
   verify.py     quote checking against the source
 tests/          schema, retry, redaction, verification, client and CLI tests
 examples/       six fictional transcripts, plus adversarial/ fixtures
+corpus/real/    ten published transcripts with provenance
 scripts/        calibration and injection harnesses
 docs/           calibration record, sample report, banner, demo
 ```
@@ -293,7 +318,8 @@ docs/           calibration record, sample report, banner, demo
 - Duplicate folding ignores formatting only; a single changed digit keeps a copy separate.
 - Type slugs are keyword-matched, so an unusual description falls to `other` rather than inventing one.
 - The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
-- Analysis is English-centric: the prompt and schema assume English artifacts.
+- The prompt asks the model to answer in the script's own language and `--language` overrides
+  detection, but the type keywords are English: a non-English script often falls to `other`.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;
   an accurate paraphrase without quotes is skipped rather than judged.
 

{scamscript-0.6.0 → scamscript-0.7.0}/README.md

@@ -94,11 +94,12 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 | `batch <dir>` | Same as above, ranked |
 | `report --run-id` | Regenerate a report from a past run's log |
 | `history` | List previous runs |
+| `brief` | One-page defence handout from a finished run |
 | `prune` | Delete old logs |
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
 `--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--dedupe/--no-dedupe`,
-`--show-duplicates`, `--type`, `--no-color`. `--json` puts one object per script on stdout and all
+`--show-duplicates`, `--type`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -119,6 +120,17 @@ The cap reads `usage.cost` from the response, so it works only where the provide
 says so when none is sent. Spend is printed and logged per run. In-flight requests can overshoot by
 up to the concurrency, so keep headroom on a hard limit.
 
+## Real corpus
+
+`corpus/real/` holds ten published transcripts with source, date and verbatim status in every
+header: a 40-minute bank impersonation call, a Medicare benefits pitch, six FTC robocalls, a
+recalled credit-union call and a USPS smishing message. Provenance and the results of running them
+are in [`docs/real-corpus.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/real-corpus.md).
+
+```bash
+scamscript --redact batch corpus/real --concurrency 3 --max-cost 0.25 --output real.md
+```
+
 ## Attack types
 
 `attack_type` is free prose, which is useful to read and useless to group. Every result also carries a
@@ -130,6 +142,12 @@ per slug above the ranking, and `--type` filters to the ones you ask for:
 scamscript batch corpus/ --type tech-support,refund --output report.md
 ```
 
+Briefings group the same way. Build one from a finished run:
+
+```bash
+scamscript brief --type tech-support --output briefing.md
+```
+
 The raw phrase is always kept next to the slug. An unrecognised description lands in `other` and the
 CLI names any filter token it did not recognise.
 
@@ -184,6 +202,12 @@ Every request appends to a timestamped JSONL file under `~/.scamscript/logs/` (o
 a run replays without spending tokens, and `prune --keep 200 --keep-days 30` keeps the store
 bounded. Directories are `0700` and log files `0600`.
 
+## Paths
+
+`--file` and `--dir` resolve symlinks, a recursive walk survives a symlink loop, and a file that
+changes while it is read is an error rather than a half-read prompt. Output files are not overwritten
+unless `--force` is passed.
+
 ## Install and configure
 
 Python 3.12+. `pip install scamscript` for use, `pip install -e ".[dev]"` from a clone for tests.
@@ -245,6 +269,7 @@ src/scamscript/
   verify.py     quote checking against the source
 tests/          schema, retry, redaction, verification, client and CLI tests
 examples/       six fictional transcripts, plus adversarial/ fixtures
+corpus/real/    ten published transcripts with provenance
 scripts/        calibration and injection harnesses
 docs/           calibration record, sample report, banner, demo
 ```
@@ -257,7 +282,8 @@ docs/           calibration record, sample report, banner, demo
 - Duplicate folding ignores formatting only; a single changed digit keeps a copy separate.
 - Type slugs are keyword-matched, so an unusual description falls to `other` rather than inventing one.
 - The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
-- Analysis is English-centric: the prompt and schema assume English artifacts.
+- The prompt asks the model to answer in the script's own language and `--language` overrides
+  detection, but the type keywords are English: a non-English script often falls to `other`.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;
   an accurate paraphrase without quotes is skipped rather than judged.