scamscript 0.7.0__tar.gz → 0.8.0__tar.gz

{scamscript-0.7.0 → scamscript-0.8.0}/CHANGELOG.md

@@ -5,6 +5,19 @@ schema are the things that count as public API.
 
 ## Unreleased
 
+## 0.8.0 - 2026-11-02
+
+### Added
+
+- `channel` field (`vishing`, `smishing`, `email`, `other`) separate from the attack theme, with
+  `--channel` filtering in reports and briefings.
+- `brief --html`: self-contained printable page, escaped and offline.
+
+### Changed
+
+- Panels show the channel; JSON records carry it; real-corpus validation confirms text lures keep
+  their delivery route.
+
 ## 0.7.0 - 2026-11-02
 
 ### Added

{scamscript-0.7.0 → scamscript-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scamscript
-Version: 0.7.0
+Version: 0.8.0
 Summary: Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/scamscript
 Project-URL: Repository, https://github.com/sjdsjadjajdjsa/scamscript
@@ -111,7 +111,7 @@ Each script renders as a colour-coded panel:
 ╰────────────────────────────────── 7 red flags ───────────────────────────────╯
 ```
 
-Fields: `attack_type`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
+Fields: `attack_type`, `channel`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
 `escalation_ladder`, `target_demographics`, `red_flags`, `defense_summary`, `sophistication_score`.
 
 The panel also carries a **quote check**: every quoted claim in `opening_hook` and `red_flags` is
@@ -135,7 +135,7 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
 `--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--dedupe/--no-dedupe`,
-`--show-duplicates`, `--type`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
+`--show-duplicates`, `--type`, `--channel`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -178,7 +178,15 @@ per slug above the ranking, and `--type` filters to the ones you ask for:
 scamscript batch corpus/ --type tech-support,refund --output report.md
 ```
 
-Briefings group the same way. Build one from a finished run:
+Delivery is tracked separately from theme. `channel` is one of `vishing`, `smishing`, `email` or
+`other`, so a delivery-themed text lure is `delivery` + `smishing` rather than losing one of the two.
+`--channel` filters on it:
+
+```bash
+scamscript batch corpus/real --channel smishing --output texts.md
+```
+
+Briefings group by type but accept `--channel` too. Build one from a finished run:
 
 ```bash
 scamscript brief --type tech-support --output briefing.md
@@ -238,6 +246,15 @@ Every request appends to a timestamped JSONL file under `~/.scamscript/logs/` (o
 a run replays without spending tokens, and `prune --keep 200 --keep-days 30` keeps the store
 bounded. Directories are `0700` and log files `0600`.
 
+## Printable briefings
+
+`brief --html` writes a self-contained page with inline CSS and escaped text, for handing to people
+who will not open a terminal.
+
+```bash
+scamscript brief --type tech-support --html --output handout.html
+```
+
 ## Paths
 
 `--file` and `--dir` resolve symlinks, a recursive walk survives a symlink loop, and a file that
@@ -318,6 +335,8 @@ docs/           calibration record, sample report, banner, demo
 - Duplicate folding ignores formatting only; a single changed digit keeps a copy separate.
 - Type slugs are keyword-matched, so an unusual description falls to `other` rather than inventing one.
 - The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
+- `channel` is inferred from the model's answer or, failing that, from keywords; a script with no
+  channel words falls to `other`.
 - The prompt asks the model to answer in the script's own language and `--language` overrides
   detection, but the type keywords are English: a non-English script often falls to `other`.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;

{scamscript-0.7.0 → scamscript-0.8.0}/README.md

@@ -75,7 +75,7 @@ Each script renders as a colour-coded panel:
 ╰────────────────────────────────── 7 red flags ───────────────────────────────╯
 ```
 
-Fields: `attack_type`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
+Fields: `attack_type`, `channel`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
 `escalation_ladder`, `target_demographics`, `red_flags`, `defense_summary`, `sophistication_score`.
 
 The panel also carries a **quote check**: every quoted claim in `opening_hook` and `red_flags` is
@@ -99,7 +99,7 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
 `--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--dedupe/--no-dedupe`,
-`--show-duplicates`, `--type`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
+`--show-duplicates`, `--type`, `--channel`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -142,7 +142,15 @@ per slug above the ranking, and `--type` filters to the ones you ask for:
 scamscript batch corpus/ --type tech-support,refund --output report.md
 ```
 
-Briefings group the same way. Build one from a finished run:
+Delivery is tracked separately from theme. `channel` is one of `vishing`, `smishing`, `email` or
+`other`, so a delivery-themed text lure is `delivery` + `smishing` rather than losing one of the two.
+`--channel` filters on it:
+
+```bash
+scamscript batch corpus/real --channel smishing --output texts.md
+```
+
+Briefings group by type but accept `--channel` too. Build one from a finished run:
 
 ```bash
 scamscript brief --type tech-support --output briefing.md
@@ -202,6 +210,15 @@ Every request appends to a timestamped JSONL file under `~/.scamscript/logs/` (o
 a run replays without spending tokens, and `prune --keep 200 --keep-days 30` keeps the store
 bounded. Directories are `0700` and log files `0600`.
 
+## Printable briefings
+
+`brief --html` writes a self-contained page with inline CSS and escaped text, for handing to people
+who will not open a terminal.
+
+```bash
+scamscript brief --type tech-support --html --output handout.html
+```
+
 ## Paths
 
 `--file` and `--dir` resolve symlinks, a recursive walk survives a symlink loop, and a file that
@@ -282,6 +299,8 @@ docs/           calibration record, sample report, banner, demo
 - Duplicate folding ignores formatting only; a single changed digit keeps a copy separate.
 - Type slugs are keyword-matched, so an unusual description falls to `other` rather than inventing one.
 - The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
+- `channel` is inferred from the model's answer or, failing that, from keywords; a script with no
+  channel words falls to `other`.
 - The prompt asks the model to answer in the script's own language and `--language` overrides
   detection, but the type keywords are English: a non-English script often falls to `other`.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;

{scamscript-0.7.0 → scamscript-0.8.0}/docs/real-corpus.md

@@ -35,3 +35,10 @@ Ten files, `--concurrency 3 --redact`, 2026-11-02, primary model:
   the model described the pattern instead of quoting a line.
 
 Recorded cost for the full directory: about two cents.
+
+## Channel split, same day
+
+A third run added the `channel` field. All nine call transcripts type as `vishing`; the USPS message
+is `delivery` + `smishing` instead of one erasing the other. The Medicare call again needed one
+repair, and the bank call produced three paraphrased quotes this time against zero the run before:
+quote drift varies by draw, which is why the checker flags rather than rewrites.

{scamscript-0.7.0 → scamscript-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "scamscript"
-version = "0.7.0"
+version = "0.8.0"
 description = "Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks"
 readme = "README.md"
 requires-python = ">=3.12"

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/__init__.py

@@ -1,3 +1,3 @@
 """scamscript: reverse-engineering analyzer for scam call scripts."""
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/analysis.py

@@ -29,6 +29,7 @@ class Outcome:
     skipped: bool = False
     fingerprint: str = ""
     attack_slug: str = ""
+    channel: str = "other"
     language: str = "unknown"
     duplicate_of: str | None = None
     issues: list[verify.Issue] | None = None
@@ -47,6 +48,7 @@ class Outcome:
             "skipped": self.skipped,
             "fingerprint": self.fingerprint,
             "attack_slug": self.attack_slug,
+            "channel": self.channel,
             "language": self.language,
             "duplicate_of": self.duplicate_of,
             "attempts": self.attempts,
@@ -130,6 +132,11 @@ def analyze_script(
             outcome.breakdown = parse_breakdown(visible)
             outcome.error = None
             outcome.attack_slug = taxonomy.slugify(outcome.breakdown.attack_type)
+            outcome.channel = (
+                outcome.breakdown.channel
+                if outcome.breakdown.channel != "other"
+                else taxonomy.channel_of(outcome.breakdown.attack_type, outcome.breakdown.opening_hook)
+            )
             if verify_quotes:
                 outcome.issues = verify.verify_breakdown(outcome.breakdown, text)
                 outcome.verification = verify.summarize(outcome.issues)

scamscript-0.8.0/src/scamscript/brief.py

@@ -0,0 +1,178 @@
+"""Turn a recorded run into a one-page defence briefing for trainers."""
+
+from __future__ import annotations
+
+from html import escape
+
+from scamscript import taxonomy
+from scamscript.report import ReportEntry
+
+MAX_FLAGS = 6
+MAX_PRESSURE = 4
+MAX_COUNTERS = 4
+
+
+def _unique(values: list[str], limit: int) -> list[str]:
+    seen: set[str] = set()
+    out: list[str] = []
+    for value in values:
+        key = value.strip().lower()
+        if not key or key in seen:
+            continue
+        seen.add(key)
+        out.append(value.strip())
+        if len(out) >= limit:
+            break
+    return out
+
+
+def groups_for(
+    entries: list[ReportEntry],
+    only_types: set[str] | None = None,
+    only_channels: set[str] | None = None,
+) -> dict[str, list[ReportEntry]]:
+    groups: dict[str, list[ReportEntry]] = {}
+    for entry in entries:
+        if not entry.ok or not entry.breakdown:
+            continue
+        slug = entry.attack_slug or taxonomy.slugify(entry.breakdown.attack_type)
+        if only_types and slug not in only_types:
+            continue
+        if only_channels and entry.channel not in only_channels:
+            continue
+        groups.setdefault(slug, []).append(entry)
+    return groups
+
+
+def _parts(group: list[ReportEntry]) -> tuple[list[str], list[str], list[str]]:
+    flags = _unique([flag for entry in group for flag in entry.breakdown.red_flags], MAX_FLAGS)
+    pressure = _unique(
+        [
+            item
+            for entry in group
+            for item in entry.breakdown.urgency_tactics + entry.breakdown.escalation_ladder
+        ],
+        MAX_PRESSURE,
+    )
+    counters = _unique([entry.breakdown.defense_summary for entry in group], MAX_COUNTERS)
+    return flags, pressure, counters
+
+
+def build_brief(
+    entries: list[ReportEntry],
+    run_id: str,
+    only_types: set[str] | None = None,
+    only_channels: set[str] | None = None,
+) -> str:
+    groups = groups_for(entries, only_types, only_channels)
+
+    lines = ["# Scam defence briefing", ""]
+    lines.append(f"Built from run `{run_id}`. Every claim comes from the analyzed scripts.")
+    lines.append("")
+    if not groups:
+        lines.append("_No matching successful analyses in this run._")
+        return "\n".join(lines) + "\n"
+
+    lines.append("Use this in order: the flags are what a target can notice, the counters are what")
+    lines.append("they should do instead of complying.")
+    lines.append("")
+
+    ordered = sorted(groups.items(), key=lambda item: (-len(item[1]), item[0]))
+    for slug, group in ordered:
+        scores = [entry.breakdown.sophistication_score for entry in group]
+        flags, pressure, counters = _parts(group)
+
+        lines.append(f"## {taxonomy.label(slug)} (`{slug}`)")
+        lines.append("")
+        lines.append(f"{len(group)} script(s), mean sophistication {sum(scores) / len(scores):.1f}/10.")
+        lines.append("")
+        lines.append("### What to notice")
+        lines.append("")
+        lines.extend(f"- {flag}" for flag in flags or ["_Nothing recorded._"])
+        lines.append("")
+        if pressure:
+            lines.append("### How pressure is applied")
+            lines.append("")
+            lines.extend(f"- {item}" for item in pressure)
+            lines.append("")
+        lines.append("### What to do")
+        lines.append("")
+        lines.extend(f"- {counter}" for counter in counters or ["_Nothing recorded._"])
+        lines.append("")
+        lines.append("### Sources")
+        lines.append("")
+        lines.extend(f"- `{entry.name}`" for entry in group)
+        lines.append("")
+
+    lines.append("---")
+    lines.append("")
+    lines.append(
+        "_Model-produced reading of captured scripts, for security research and fraud-awareness "
+        "training only._"
+    )
+    lines.append("")
+    return "\n".join(lines)
+
+
+STYLE = """
+:root { color-scheme: light dark; }
+body { font: 16px/1.55 system-ui, sans-serif; max-width: 46rem; margin: 2rem auto; padding: 0 1rem; }
+h1 { font-size: 1.6rem; } h2 { font-size: 1.2rem; margin-top: 2rem; border-top: 1px solid #8884; padding-top: 1rem; }
+h3 { font-size: .95rem; text-transform: uppercase; letter-spacing: .04em; margin-bottom: .3rem; }
+ul { margin-top: .2rem; } .meta { color: #777; } .slug { font-family: ui-monospace, monospace; color: #777; }
+footer { margin-top: 2rem; color: #777; font-size: .85rem; }
+"""
+
+
+def build_brief_html(
+    entries: list[ReportEntry],
+    run_id: str,
+    only_types: set[str] | None = None,
+    only_channels: set[str] | None = None,
+) -> str:
+    groups = groups_for(entries, only_types, only_channels)
+    out = [
+        "<!DOCTYPE html>",
+        '<html lang="en"><head><meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width, initial-scale=1">',
+        "<title>Scam defence briefing</title>",
+        f"<style>{STYLE}</style></head><body>",
+        "<h1>Scam defence briefing</h1>",
+        f'<p class="meta">Built from run <code>{escape(run_id)}</code>. '
+        "Every claim comes from the analyzed scripts.</p>",
+    ]
+    if not groups:
+        out.append("<p><em>No matching successful analyses in this run.</em></p>")
+    else:
+        out.append(
+            "<p>The flags are what a target can notice. The counters are what to do instead of "
+            "complying.</p>"
+        )
+    for slug, group in sorted(groups.items(), key=lambda item: (-len(item[1]), item[0])):
+        scores = [entry.breakdown.sophistication_score for entry in group]
+        flags, pressure, counters = _parts(group)
+        out.append("<section>")
+        out.append(
+            f"<h2>{escape(taxonomy.label(slug))} <span class=\"slug\">({escape(slug)})</span></h2>"
+        )
+        out.append(
+            f'<p class="meta">{len(group)} script(s), mean sophistication '
+            f"{sum(scores) / len(scores):.1f}/10.</p>"
+        )
+        out.append("<h3>What to notice</h3><ul>")
+        out.extend(f"<li>{escape(flag)}</li>" for flag in flags or ["Nothing recorded."])
+        out.append("</ul>")
+        if pressure:
+            out.append("<h3>How pressure is applied</h3><ul>")
+            out.extend(f"<li>{escape(item)}</li>" for item in pressure)
+            out.append("</ul>")
+        out.append("<h3>What to do</h3><ul>")
+        out.extend(f"<li>{escape(counter)}</li>" for counter in counters or ["Nothing recorded."])
+        out.append("</ul><h3>Sources</h3><ul>")
+        out.extend(f"<li><code>{escape(entry.name)}</code></li>" for entry in group)
+        out.append("</ul></section>")
+    out.append(
+        "<footer>Model-produced reading of captured scripts. Security research and "
+        "fraud-awareness training only.</footer></body></html>"
+    )
+    return "\n".join(out) + "\n"

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/cli.py

@@ -241,6 +241,7 @@ def _run(
     output: Path | None,
     top: int | None,
     types: list[str] | None = None,
+    channels: list[str] | None = None,
     force: bool = False,
 ) -> None:
     console = state.console
@@ -429,6 +430,17 @@ def _run(
             console.print(
                 f"[yellow]note[/yellow] unknown type(s): {', '.join(sorted(unknown))}"
             )
+    only_channels = {
+        chunk.strip().lower()
+        for value in channels or []
+        for chunk in value.split(",")
+        if chunk.strip()
+    }
+    invalid_channels = only_channels - set(taxonomy.CHANNELS)
+    if invalid_channels:
+        console.print(
+            f"[yellow]note[/yellow] unknown channel(s): {', '.join(sorted(invalid_channels))}"
+        )
     collapsed = reporting.collapse(report_entries) if state.dedupe else report_entries
 
     if batch_mode and (successes or skipped):
@@ -448,6 +460,7 @@ def _run(
             command=command,
             model=settings.model,
             only_types=only_types,
+            only_channels=only_channels,
         )
         written = _emit_report(
             console, markdown, output, json_mode=state.json_output, force=force
@@ -527,6 +540,9 @@ def analyze(
         None, "--type", help="Only report these type slugs (repeatable or comma-separated)."
     ),
     force: bool = typer.Option(False, "--force", help="Overwrite an existing output file."),
+    channels: list[str] | None = typer.Option(
+        None, "--channel", help="Only report these channels (vishing, smishing, email, other)."
+    ),
 ) -> None:
     """Analyze a single script file, or a directory with --batch."""
     state = _context(ctx)
@@ -547,6 +563,7 @@ def analyze(
         output=output,
         top=top,
         types=types,
+        channels=channels,
         force=force,
     )
 
@@ -564,6 +581,9 @@ def batch(
         None, "--type", help="Only report these type slugs (repeatable or comma-separated)."
     ),
     force: bool = typer.Option(False, "--force", help="Overwrite an existing output file."),
+    channels: list[str] | None = typer.Option(
+        None, "--channel", help="Only report these channels (vishing, smishing, email, other)."
+    ),
 ) -> None:
     """Analyze a directory and rank every script by sophistication."""
     state = _context(ctx)
@@ -580,6 +600,7 @@ def batch(
         output=output,
         top=top,
         types=types,
+        channels=channels,
         force=force,
     )
 
@@ -596,6 +617,9 @@ def report(  # noqa: A001
         None, "--type", help="Only report these type slugs (repeatable or comma-separated)."
     ),
     force: bool = typer.Option(False, "--force", help="Overwrite an existing output file."),
+    channels: list[str] | None = typer.Option(
+        None, "--channel", help="Only report these channels (vishing, smishing, email, other)."
+    ),
 ) -> None:
     """Regenerate the aggregated report from a past run's log."""
     state = _context(ctx)
@@ -623,6 +647,12 @@ def report(  # noqa: A001
         command=str(run.get("command") or "report"),
         model=run.get("model"),
         only_types=taxonomy.parse_filter(types),
+        only_channels={
+            chunk.strip().lower()
+            for value in channels or []
+            for chunk in value.split(",")
+            if chunk.strip()
+        },
     )
     _emit_report(state.console, markdown, output, force=force)
 
@@ -673,9 +703,15 @@ def brief(
     types: list[str] | None = typer.Option(
         None, "--type", help="Only brief these type slugs (repeatable or comma-separated)."
     ),
+    channels: list[str] | None = typer.Option(
+        None, "--channel", help="Only brief these channels (vishing, smishing, email, other)."
+    ),
     output: Path | None = typer.Option(None, "--output", "-o", help="Write the briefing here."),
     logs_dir: Path | None = typer.Option(None, "--logs-dir", help="Override the log directory."),
     force: bool = typer.Option(False, "--force", help="Overwrite an existing output file."),
+    as_html: bool = typer.Option(
+        False, "--html", help="Emit a standalone HTML page instead of markdown."
+    ),
 ) -> None:
     """Build a one-page defence briefing from a past run."""
     state = _context(ctx)
@@ -694,10 +730,17 @@ def brief(
             return
 
     entries = reporting.entries_from_run(run)
-    markdown = briefing.build_brief(
+    builder = briefing.build_brief_html if as_html else briefing.build_brief
+    markdown = builder(
         entries,
         run_id=str(run["run_id"]),
         only_types=taxonomy.parse_filter(types),
+        only_channels={
+            chunk.strip().lower()
+            for value in channels or []
+            for chunk in value.split(",")
+            if chunk.strip()
+        },
     )
     _emit_report(state.console, markdown, output, force=force)
     if output:

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/client.py

@@ -63,7 +63,7 @@ class ChatClient:
                 "Authorization": f"Bearer {api_key}",
                 "Content-Type": "application/json",
                 "Accept": "application/json",
-                "User-Agent": "scamscript/0.7.0",
+                "User-Agent": "scamscript/0.8.0",
             },
         )
 

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/models.py

@@ -33,6 +33,7 @@ class ScriptBreakdown(BaseModel):
     model_config = ConfigDict(extra="ignore", str_strip_whitespace=True)
 
     attack_type: str
+    channel: str = "other"
     persona: str
     opening_hook: str
     trust_building_moves: list[str]
@@ -76,6 +77,22 @@ class ScriptBreakdown(BaseModel):
             return out
         return [str(value)]
 
+    @field_validator("channel", mode="before")
+    @classmethod
+    def _channel(cls, value: Any) -> str:
+        text = str(value or "").strip().lower()
+        aliases = {
+            "call": "vishing",
+            "phone": "vishing",
+            "voice": "vishing",
+            "text": "smishing",
+            "sms": "smishing",
+            "whatsapp": "smishing",
+            "mail": "email",
+        }
+        text = aliases.get(text, text)
+        return text if text in {"vishing", "smishing", "email", "other"} else "other"
+
     @field_validator("sophistication_score", mode="before")
     @classmethod
     def _coerce_score(cls, value: Any) -> int:

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/prompts.py

@@ -22,6 +22,7 @@ markdown. It must validate against this schema:
 
 {
   "attack_type": "string: the fraud family, e.g. vishing, smishing, romance scam, tech support scam, government impersonation, refund scam, crypto investment scam",
+  "channel": "string: the delivery route, exactly one of vishing, smishing, email, other",
   "persona": "string: the identity, authority, and tone the caller adopts, including any claimed employer, department, or credentials",
   "opening_hook": "string: the literal first line or lure that grabs attention, quoted from the script when present",
   "trust_building_moves": ["string: each credibility move in order, e.g. badge numbers, case IDs, hold music, spoofed caller ID, callback numbers, jargon"],
@@ -34,6 +35,7 @@ markdown. It must validate against this schema:
 }
 
 Rules:
+- channel is about delivery, not theme: a delivery-themed text message is channel smishing, a phone call is vishing.
 - opening_hook must quote the script verbatim when it has dialogue.
 - Every list must hold at least three concrete items unless the artifact truly cannot support that, in which case give what exists.
 - escalation_ladder must be ordered and must end with the walk-away path.

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/render.py

@@ -118,6 +118,7 @@ def render_breakdown(
         style=SECTION_COLORS["attack_type"],
     )
     attack.append("   ")
+    attack.append(f"VIA {breakdown.channel.upper()}  ", style="dim")
     attack.append("SOPHISTICATION  ", style="dim")
     attack.append(
         f"{breakdown.sophistication_score}/10",

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/report.py

@@ -33,6 +33,7 @@ class ReportEntry:
     skipped: bool = False
     fingerprint: str = ""
     attack_slug: str = ""
+    channel: str = "other"
     duplicates: list[str] | None = None
     verification: dict[str, int] | None = None
     unverified: list[dict[str, str]] | None = None
@@ -50,6 +51,7 @@ def entry_from_outcome(outcome: Any) -> ReportEntry:
         skipped=getattr(outcome, "skipped", False),
         fingerprint=getattr(outcome, "fingerprint", ""),
         attack_slug=getattr(outcome, "attack_slug", ""),
+        channel=getattr(outcome, "channel", "other"),
         error=outcome.error,
         duration=getattr(outcome, "duration", 0.0),
         verification=getattr(outcome, "verification", None),
@@ -79,6 +81,7 @@ def entries_from_run(run: dict[str, Any]) -> list[ReportEntry]:
                 skipped=bool(record.get("skipped")),
                 fingerprint=record.get("fingerprint") or "",
                 attack_slug=record.get("attack_slug") or "",
+                channel=record.get("channel") or "other",
                 duplicates=record.get("duplicates") or None,
                 error=None if breakdown else record.get("error") or "no breakdown stored",
                 duration=float(record.get("duration_s") or 0.0),
@@ -129,7 +132,10 @@ def build_markdown(
     command: str = "batch",
     model: str | None = None,
     only_types: set[str] | None = None,
+    only_channels: set[str] | None = None,
 ) -> str:
+    if only_channels:
+        entries = [entry for entry in entries if not entry.ok or entry.channel in only_channels]
     if only_types:
         entries = [
             entry
@@ -177,12 +183,13 @@ def build_markdown(
         lines.append("")
         lines.append("## Ranking by sophistication")
         lines.append("")
-        lines.append("| Rank | Script | Type | Sophistication | Red flags | Unverified | Copies |")
-        lines.append("| ---: | --- | --- | ---: | ---: | ---: | ---: |")
+        lines.append("| Rank | Script | Type | Channel | Sophistication | Red flags | Unverified | Copies |")
+        lines.append("| ---: | --- | --- | --- | ---: | ---: | ---: | ---: |")
         for position, entry in enumerate(ok, start=1):
             lines.append(
                 f"| {position} | {_cell(entry.name)} | "
                 f"`{entry.attack_slug or taxonomy.slugify(entry.breakdown.attack_type)}` | "
+                f"`{entry.channel}` | "
                 f"{entry.breakdown.sophistication_score}/10 | {entry.breakdown.flag_count} | "
                 f"{len(entry.unverified or [])} | {1 + len(entry.duplicates or [])} |"
             )
@@ -225,6 +232,7 @@ def _detail_section(position: int, entry: ReportEntry) -> list[str]:
     lines.append(
         f"- **Type slug:** `{entry.attack_slug or taxonomy.slugify(breakdown.attack_type)}`"
     )
+    lines.append(f"- **Channel:** `{entry.channel}`")
     lines.append(f"- **Sophistication:** {breakdown.sophistication_score}/10")
     lines.append(f"- **Red flags observed:** {breakdown.flag_count}")
     if entry.duplicates:

{scamscript-0.7.0 → scamscript-0.8.0}/src/scamscript/taxonomy.py

@@ -24,6 +24,13 @@ RULES: tuple[tuple[str, tuple[str, ...]], ...] = (
     ("vishing", ("vishing", "phone call", "cold call", "robocall", "phone")),
 )
 
+CHANNELS = ("vishing", "smishing", "email", "other")
+CHANNEL_RULES = (
+    ("vishing", ("vishing", "call", "phone", "robocall", "cold call", "landline")),
+    ("smishing", ("smishing", "sms", "text message", "text-message", "whatsapp")),
+    ("email", ("email", "e-mail", "phishing email")),
+)
+
 SLUGS = tuple(slug for slug, _ in RULES) + (OTHER,)
 NON_WORD = re.compile(r"[^a-z0-9]+")
 MATCHERS: tuple[tuple[str, re.Pattern[str]], ...] = tuple(
@@ -41,6 +48,15 @@ def slugify(attack_type: str) -> str:
     return OTHER
 
 
+def channel_of(*texts: str) -> str:
+    """Infer the delivery channel when the model did not supply one."""
+    text = NON_WORD.sub(" ", " ".join(texts).lower())
+    for channel, needles in CHANNEL_RULES:
+        if any(re.search(r"\b" + re.escape(n) + r"\b", text) for n in needles):
+            return channel
+    return "other"
+
+
 def unknown(values: list[str] | None) -> set[str]:
     """Raw filter tokens that are not a known slug."""
     if not values:

{scamscript-0.7.0 → scamscript-0.8.0}/tests/test_brief.py

@@ -55,3 +55,22 @@ def test_brief_caps_list_length():
     flags = [f"flag {i}" for i in range(10)]
     out = build_brief([entry("a", "vishing", flags, "c")], run_id="r")
     assert out.count("- flag ") == 6
+
+
+def test_html_brief_structure_and_escaping():
+    from scamscript.brief import build_brief_html
+
+    out = build_brief_html(
+        [entry("a<b>.txt", "vishing", ["<script>alert(1)</script>"], "hang up & verify")], run_id="r"
+    )
+    assert out.startswith("<!DOCTYPE html>")
+    assert "<script>alert(1)</script>" not in out
+    assert "&lt;script&gt;alert(1)&lt;/script&gt;" in out
+    assert "hang up &amp; verify" in out
+    assert "<title>Scam defence briefing</title>" in out
+
+
+def test_html_brief_empty():
+    from scamscript.brief import build_brief_html
+
+    assert "No matching successful analyses" in build_brief_html([], run_id="r")

{scamscript-0.7.0 → scamscript-0.8.0}/tests/test_cli.py

@@ -146,15 +146,13 @@ def test_batch_top_limits_report(home, tmp_path, fake):
     assert "## 2." not in markdown
 
 
-def test_failure_exits_nonzero(home, tmp_path, fake):
+def test_failure_exits_nonzero(home, tmp_path, fake, monkeypatch):
     (tmp_path / "a.txt").write_text("CALLER: x", encoding="utf-8")
     fake.default = None
-    original = FakeClient.complete
-    fake.complete = lambda self, messages, **kwargs: "not json"
+    monkeypatch.setattr(FakeClient, "complete", lambda self, messages, **kwargs: "not json")
     result = runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(tmp_path / "a.txt")])
     assert result.exit_code == 1
     assert "FAILED" in result.stdout
-    fake.complete = original
 
 
 def test_report_replays_logged_run(home, tmp_path, fake):
@@ -230,7 +228,7 @@ def test_dry_run_without_endpoint(home, tmp_path, monkeypatch):
 def test_version(home):
     result = runner.invoke(cli.app, ["--version"])
     assert result.exit_code == 0
-    assert result.stdout.strip() == "scamscript 0.7.0"
+    assert result.stdout.strip() == "scamscript 0.8.0"
 
 
 def test_json_output_is_one_object_per_script(home, tmp_path, fake):
@@ -480,14 +478,14 @@ def test_unknown_type_warns(home, tmp_path, fake):
     assert "unknown type" in result.stdout
 
 
-def test_language_override_reaches_prompt(home, tmp_path, fake):
+def test_language_override_reaches_prompt(home, tmp_path, fake, monkeypatch):
     seen = {}
 
     def complete(self, messages, **kwargs):
         seen["prompt"] = messages[-1]["content"]
         return json.dumps(breakdown())
 
-    fake.complete = complete
+    monkeypatch.setattr(FakeClient, "complete", complete)
     script = tmp_path / "a.txt"
     script.write_text("CALLER: hola", encoding="utf-8")
     result = runner.invoke(
@@ -495,4 +493,50 @@ def test_language_override_reaches_prompt(home, tmp_path, fake):
     )
     assert result.exit_code == 0
     assert "'es'" in seen["prompt"]
-    fake.complete = FakeClient.complete
+
+
+def test_channel_filter_and_unknown_warning(home, tmp_path, fake):
+    (tmp_path / "a.txt").write_text("CALLER: call me", encoding="utf-8")
+    (tmp_path / "b.txt").write_text("CALLER: text me", encoding="utf-8")
+    vish = breakdown()
+    vish["channel"] = "vishing"
+    smish = breakdown()
+    smish["channel"] = "smishing"
+    fake.replies = {"a.txt": vish, "b.txt": smish}
+    out = tmp_path / "r.md"
+    result = runner.invoke(
+        cli.app, ["--api-key", "k", "batch", str(tmp_path), "--channel", "vishing", "--output", str(out)]
+    )
+    assert result.exit_code == 0
+    assert "a.txt" in out.read_text() and "b.txt" not in out.read_text()
+
+
+def test_unknown_channel_warns(home, tmp_path, fake):
+    (tmp_path / "a.txt").write_text("CALLER: x", encoding="utf-8")
+    result = runner.invoke(cli.app, ["--api-key", "k", "batch", str(tmp_path), "--channel", "carrier-pigeon"])
+    assert result.exit_code == 0
+    assert "unknown channel" in result.stdout
+
+
+def test_brief_html_output(home, tmp_path, fake):
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: x", encoding="utf-8")
+    runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    out = tmp_path / "b.html"
+    result = runner.invoke(cli.app, ["brief", "--html", "--output", str(out)])
+    assert result.exit_code == 0
+    assert out.read_text().startswith("<!DOCTYPE html>")
+
+
+def test_brief_refuses_overwrite_without_force(home, tmp_path, fake):
+    script = tmp_path / "a.txt"
+    script.write_text("CALLER: x", encoding="utf-8")
+    runner.invoke(cli.app, ["--api-key", "k", "analyze", "--file", str(script)])
+    out = tmp_path / "b.md"
+    out.write_text("old", encoding="utf-8")
+    refused = runner.invoke(cli.app, ["brief", "--output", str(out)])
+    assert refused.exit_code == 1
+    assert "pass --force" in refused.stdout
+    forced = runner.invoke(cli.app, ["brief", "--output", str(out), "--force"])
+    assert forced.exit_code == 0
+    assert "Scam defence briefing" in out.read_text()

{scamscript-0.7.0 → scamscript-0.8.0}/tests/test_report.py

@@ -31,7 +31,7 @@ def test_markdown_has_summary_and_details():
     ]
     markdown = build_markdown(entries, run_id="run-1", command="batch", model="m")
     assert "# Scam script breakdown report" in markdown
-    assert "| 1 | a.txt | `vishing` | 9/10 | 1 | 0 | 1 |" in markdown
+    assert "| 1 | a.txt | `vishing` | `other` | 9/10 | 1 | 0 | 1 |" in markdown
     assert "## Failures" in markdown
     assert "bad json" in markdown
     assert "### Defense summary" in markdown
@@ -90,3 +90,12 @@ def test_type_filter_keeps_only_allowed_and_failures():
     assert "a.txt" in markdown
     assert "b.txt" not in markdown
     assert "bad.txt" in markdown
+
+
+def test_channel_filter():
+    entries = [
+        ReportEntry(name="a.txt", source="a", breakdown=breakdown(5), channel="vishing"),
+        ReportEntry(name="b.txt", source="b", breakdown=breakdown(5), channel="smishing"),
+    ]
+    markdown = build_markdown(entries, run_id="r", only_channels={"vishing"})
+    assert "a.txt" in markdown and "b.txt" not in markdown

{scamscript-0.7.0 → scamscript-0.8.0}/tests/test_taxonomy.py

@@ -54,3 +54,25 @@ def test_parse_filter_accepts_comma_and_spaces():
 def test_label_known_and_fallback():
     assert label("bec") == "Business email compromise"
     assert label("odd") == "odd"
+
+
+@pytest.mark.parametrize(
+    "texts,channel",
+    [
+        (("USPS delivery smishing text",), "smishing"),
+        (("phone robocall",), "vishing"),
+        (("vendor invoice", "email"), "email"),
+        (("something",), "other"),
+        (("first", "second"), "other"),
+    ],
+)
+def test_channel_of(texts, channel):
+    from scamscript.taxonomy import channel_of
+
+    assert channel_of(*texts) == channel
+
+
+def test_channel_matching_uses_word_boundaries():
+    from scamscript.taxonomy import channel_of
+
+    assert channel_of("rainfall") == "other"

scamscript-0.7.0/src/scamscript/brief.py

@@ -1,95 +0,0 @@
-"""Turn a recorded run into a one-page defence briefing for trainers."""
-
-from __future__ import annotations
-
-from scamscript import taxonomy
-from scamscript.report import ReportEntry
-
-MAX_FLAGS = 6
-MAX_PRESSURE = 4
-MAX_COUNTERS = 4
-
-
-def _unique(values: list[str], limit: int) -> list[str]:
-    seen: set[str] = set()
-    out: list[str] = []
-    for value in values:
-        key = value.strip().lower()
-        if not key or key in seen:
-            continue
-        seen.add(key)
-        out.append(value.strip())
-        if len(out) >= limit:
-            break
-    return out
-
-
-def build_brief(
-    entries: list[ReportEntry], run_id: str, only_types: set[str] | None = None
-) -> str:
-    groups: dict[str, list[ReportEntry]] = {}
-    for entry in entries:
-        if not entry.ok or not entry.breakdown:
-            continue
-        slug = entry.attack_slug or taxonomy.slugify(entry.breakdown.attack_type)
-        if only_types and slug not in only_types:
-            continue
-        groups.setdefault(slug, []).append(entry)
-
-    lines = ["# Scam defence briefing", ""]
-    lines.append(f"Built from run `{run_id}`. Every claim comes from the analyzed scripts.")
-    lines.append("")
-    if not groups:
-        lines.append("_No matching successful analyses in this run._")
-        return "\n".join(lines) + "\n"
-
-    lines.append("Use this in order: the flags are what a target can notice, the counters are what")
-    lines.append("they should do instead of complying.")
-    lines.append("")
-
-    ordered = sorted(groups.items(), key=lambda item: (-len(item[1]), item[0]))
-    for slug, group in ordered:
-        scores = [entry.breakdown.sophistication_score for entry in group]
-        flags = _unique([flag for entry in group for flag in entry.breakdown.red_flags], MAX_FLAGS)
-        pressure = _unique(
-            [
-                item
-                for entry in group
-                for item in entry.breakdown.urgency_tactics + entry.breakdown.escalation_ladder
-            ],
-            MAX_PRESSURE,
-        )
-        counters = _unique(
-            [entry.breakdown.defense_summary for entry in group], MAX_COUNTERS
-        )
-
-        lines.append(f"## {taxonomy.label(slug)} (`{slug}`)")
-        lines.append("")
-        lines.append(f"{len(group)} script(s), mean sophistication {sum(scores) / len(scores):.1f}/10.")
-        lines.append("")
-        lines.append("### What to notice")
-        lines.append("")
-        lines.extend(f"- {flag}" for flag in flags or ["_Nothing recorded._"])
-        lines.append("")
-        if pressure:
-            lines.append("### How pressure is applied")
-            lines.append("")
-            lines.extend(f"- {item}" for item in pressure)
-            lines.append("")
-        lines.append("### What to do")
-        lines.append("")
-        lines.extend(f"- {counter}" for counter in counters or ["_Nothing recorded._"])
-        lines.append("")
-        lines.append("### Sources")
-        lines.append("")
-        lines.extend(f"- `{entry.name}`" for entry in group)
-        lines.append("")
-
-    lines.append("---")
-    lines.append("")
-    lines.append(
-        "_Model-produced reading of captured scripts, for security research and fraud-awareness "
-        "training only._"
-    )
-    lines.append("")
-    return "\n".join(lines)