voidaccess 1.8.0__tar.gz → 1.8.2__tar.gz

{voidaccess-1.8.0/voidaccess.egg-info → voidaccess-1.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 1.8.0
+Version: 1.8.2
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT

{voidaccess-1.8.0 → voidaccess-1.8.2}/db/models.py

@@ -75,7 +75,7 @@ class RelationshipType(str, enum.Enum):
     LINKED_TO = "LINKED_TO"
     PAID_TO = "PAID_TO"
     MEMBER_OF = "MEMBER_OF"
-    USED = "USED"
+    USES = "USES"
     CLAIMED = "CLAIMED"
     LIKELY_SAME_ACTOR = "LIKELY_SAME_ACTOR"
     CONFIRMED_SAME_ACTOR = "CONFIRMED_SAME_ACTOR"

{voidaccess-1.8.0 → voidaccess-1.8.2}/export/ioc_package.py

@@ -54,7 +54,7 @@ logger = logging.getLogger(__name__)
 # ---------------------------------------------------------------------------
 
 PACKAGE_FORMAT = "voidaccess-ioc-v1"
-PACKAGE_VERSION = "1.8.0"
+PACKAGE_VERSION = "1.8.2"
 SNORT_SID_BASE = 9000001  # 9xxxxxx reserved for VoidAccess-generated rules
 
 # Map extractor upper-case entity types to the per-file bucket they belong to.

{voidaccess-1.8.0 → voidaccess-1.8.2}/export/stix.py

@@ -508,7 +508,7 @@ def _edge_type_to_stix(edge_type: str) -> str:
         "LINKED_TO": "related-to",
         "PAID_TO": "related-to",
         "MEMBER_OF": "member-of",
-        "USED": "uses",
+        "USES": "uses",
         "CLAIMED": "attributed-to",
         "LIKELY_SAME_ACTOR": "related-to",
         "CONFIRMED_SAME_ACTOR": "related-to",

{voidaccess-1.8.0 → voidaccess-1.8.2}/extractor/normalizer.py

@@ -887,6 +887,27 @@ _RFC5737_NETWORKS: list[tuple[str, str]] = [
     ("203.0.113.0", "255.255.255.0"),   # 203.0.113.0/24
 ]
 
+# Real, routable IPs that are never a meaningful indicator of compromise:
+# the unspecified/null address, the broadcast address, and the well-known
+# public DNS resolvers that appear constantly in technical content for
+# reasons unrelated to being an IOC.  Filtered like the RFC 5737 ranges so a
+# user pulling ip_addresses.txt into a blocklist can't end up blocking a
+# legitimate public resolver or a null route.
+_NON_ACTIONABLE_IPS: frozenset[str] = frozenset({
+    "0.0.0.0",              # unspecified / null route — never a real host
+    "255.255.255.255",      # limited broadcast
+    "8.8.8.8", "8.8.4.4",           # Google Public DNS
+    "1.1.1.1", "1.0.0.1",           # Cloudflare Public DNS
+    "9.9.9.9", "149.112.112.112",   # Quad9
+    "208.67.222.222", "208.67.220.220",  # OpenDNS
+    "4.2.2.1", "4.2.2.2",           # Level3 legacy resolvers
+})
+
+
+def _is_non_actionable_ip(value: str) -> bool:
+    """Return True for real IPs that are never meaningful IOCs (null route, public DNS)."""
+    return value.strip() in _NON_ACTIONABLE_IPS
+
 # RFC 2606 reserved domain names.
 _RFC2606_DOMAINS: frozenset[str] = frozenset({
     "example.com",
@@ -1563,6 +1584,14 @@ def normalize_entities(
                 )
                 continue
 
+            if entity_type == "IP_ADDRESS" and _is_non_actionable_ip(canonical):
+                source_quality = 0.0
+                logger.debug(
+                    "Non-actionable IP rejected (null route / broadcast / public DNS resolver): %s",
+                    canonical,
+                )
+                continue
+
             if entity_type == "DOMAIN" and _is_rfc2606_domain(canonical):
                 source_quality = 0.0
                 logger.debug(

{voidaccess-1.8.0 → voidaccess-1.8.2}/extractor/pipeline.py

@@ -574,6 +574,23 @@ async def extract_entities_from_pages(
                     )
                     page_id_by_url[_url] = _p.get("page_id")
 
+                # Some clearnet/side-source pages are materialized in the DB
+                # during entity persistence, after the CLI's initial page-id
+                # lookup.  Resolve those URLs again before relationship
+                # extraction so provenance is never lost to that ordering.
+                missing_urls = [url for url, page_id in page_id_by_url.items() if page_id is None]
+                if missing_urls:
+                    from db.models import Page  # noqa: PLC0415
+
+                    with get_session() as _page_session:
+                        persisted_pages = (
+                            _page_session.query(Page)
+                            .filter(Page.url.in_(missing_urls))
+                            .all()
+                        )
+                        for _page in persisted_pages:
+                            page_id_by_url[_page.url] = _page.id
+
                 max_rel_pages = int(
                     getattr(_config, "MAX_REL_PAGES_PER_INV", 10) or 10
                 )

{voidaccess-1.8.0 → voidaccess-1.8.2}/extractor/relationship_extract.py

@@ -60,8 +60,8 @@ _DEFAULT_MAX_RELATIONSHIPS_PER_PAGE = 60
 # EDGE_TYPES).  Passive forms map to the same stored type but flip the edge
 # direction (handled below) so the stored edge always reads source -> target.
 _LLM_REL_VOCAB: dict[str, str] = {
-    "uses": "USED",
-    "used": "USED",
+    "uses": "USES",
+    "used": "USES",
     "drops": "DROPS",
     "controls": "CONTROLS",
     "targets": "TARGETS",
@@ -76,6 +76,77 @@ _PASSIVE_REL_VOCAB: dict[str, str] = {
     "controlled_by": "CONTROLS",
 }
 
+# Endpoint-type validation is deliberately kept in the relationship extractor
+# so the prompt and the independent post-LLM gate share one source of truth.
+# The sets are intentionally permissive for the project's current normalized
+# entity vocabulary; unknown types are not accepted for typed edges.
+_RELATIONSHIP_TYPE_COMPATIBILITY: dict[str, tuple[set[str], set[str]]] = {
+    "USES": (
+        {"RANSOMWARE_GROUP", "THREAT_ACTOR", "THREAT_ACTOR_HANDLE"},
+        {"MALWARE_FAMILY", "MALWARE", "TOOL", "SOFTWARE"},
+    ),
+    "DROPS": (
+        {"MALWARE_FAMILY", "MALWARE"},
+        {
+            "MALWARE_FAMILY", "MALWARE", "FILE_HASH_MD5", "FILE_HASH_SHA1",
+            "FILE_HASH_SHA256",
+        },
+    ),
+    "CONTROLS": (
+        {"RANSOMWARE_GROUP", "THREAT_ACTOR", "THREAT_ACTOR_HANDLE"},
+        {
+            "CRYPTO_WALLET", "BITCOIN_ADDRESS", "MONERO_ADDRESS", "ETH_ADDRESS",
+            "ETHEREUM_ADDRESS", "LITECOIN_ADDRESS", "ZCASH_ADDRESS",
+            "DOGECOIN_ADDRESS", "XRP_ADDRESS", "SOLANA_ADDRESS", "TRON_ADDRESS",
+            "BITCOIN_CASH_ADDRESS", "DASH_ADDRESS", "IP_ADDRESS", "IPV6_ADDRESS",
+            "DOMAIN", "ENS_DOMAIN", "ONION_URL",
+        },
+    ),
+    "TARGETS": (
+        {"RANSOMWARE_GROUP", "THREAT_ACTOR", "THREAT_ACTOR_HANDLE", "MALWARE_FAMILY", "MALWARE"},
+        {"ORGANIZATION_NAME"},
+    ),
+    "EXPLOITS": (
+        {"RANSOMWARE_GROUP", "THREAT_ACTOR", "THREAT_ACTOR_HANDLE", "MALWARE_FAMILY", "MALWARE"},
+        {"CVE", "CVE_NUMBER", "EXPLOIT_DB_ID"},
+    ),
+    "COMMUNICATES_WITH": (
+        {"RANSOMWARE_GROUP", "THREAT_ACTOR", "THREAT_ACTOR_HANDLE", "MALWARE_FAMILY", "MALWARE"},
+        {
+            "IP_ADDRESS", "IPV6_ADDRESS", "DOMAIN", "ENS_DOMAIN", "ONION_URL",
+            "TELEGRAM_HANDLE", "DISCORD_HANDLE", "XMPP_JID", "TOX_ID",
+            "MATRIX_HANDLE", "WIRE_HANDLE", "ICQ_NUMBER", "WICKR_ID",
+            "PHONE_NUMBER", "EMAIL_ADDRESS",
+        },
+    ),
+}
+
+
+def _entity_type(entity: dict) -> str:
+    return str(entity.get("type", "") or "").strip().upper()
+
+
+def _is_compatible_relationship(rel_type: str, source: dict, target: dict) -> bool:
+    """Validate endpoint types independently of the LLM's claimed verb."""
+    allowed = _RELATIONSHIP_TYPE_COMPATIBILITY.get(rel_type)
+    if allowed is None:
+        return False
+    source_types, target_types = allowed
+    return _entity_type(source) in source_types and _entity_type(target) in target_types
+
+
+def _compatibility_guide() -> str:
+    lines = []
+    for rel_type, (sources, targets) in _RELATIONSHIP_TYPE_COMPATIBILITY.items():
+        lines.append(
+            f"- {rel_type}: source {{{', '.join(sorted(sources))}}} -> "
+            f"target {{{', '.join(sorted(targets))}}}"
+        )
+    return "\n".join(lines)
+
+
+_COMPATIBILITY_GUIDE = _compatibility_guide()
+
 _PROMPT_TEMPLATE = (
     "You are a threat intelligence analyst. Below is a numbered list of "
     "entities that were already extracted from a single dark-web page, "
@@ -100,6 +171,9 @@ _PROMPT_TEMPLATE = (
     "Plain co-occurrence is captured elsewhere — omit pairs that have no "
     "specific relationship.\n"
     "- Do not output any text outside the JSON object.\n\n"
+    "Entity-type compatibility guide (source -> target):\n"
+    "{compatibility_guide}\n"
+    "Only emit a relationship when BOTH endpoint types match this guide.\n\n"
     "Entities:\n{entities}\n\n"
     "Content:\n{content}"
 )
@@ -144,17 +218,41 @@ def _parse_relationship_json(raw: str) -> list[dict]:
     return rels if isinstance(rels, list) else []
 
 
+class RelationshipLLMCallError(Exception):
+    """Raised when the relationship-extraction LLM invocation itself fails.
+
+    Distinct from a call that *succeeds* and legitimately returns no
+    relationships — callers use this to log a visible warning so a broken LLM
+    integration can never masquerade as "the LLM found no relationships".
+    """
+
+
 async def _invoke_llm(prompt: str, llm) -> str:
-    """Call the LLM with streaming/callbacks disabled (mirrors llm_extract)."""
-    try:
+    """Call the LLM with streaming/callbacks disabled (mirrors llm_extract).
+
+    Raises :class:`RelationshipLLMCallError` if the underlying invocation
+    fails, so the caller can distinguish a *failed* call from a successful
+    call that found nothing.
+    """
+    # ``bind(callbacks=[])`` puts ``callbacks`` into the model's invocation
+    # kwargs, which LangChain forwards to ``agenerate_prompt`` as ``**kwargs``
+    # — while ``ainvoke`` ALSO passes ``callbacks`` explicitly, raising
+    # "agenerate_prompt() got multiple values for keyword argument 'callbacks'".
+    # ``with_config`` overrides callbacks for this call WITHOUT adding model
+    # kwargs, exactly as extractor/llm_extract._extract_chunk does.
+    if hasattr(llm, "with_config"):
+        silent_llm = llm.with_config({"callbacks": []})
+    else:
         silent_llm = llm.bind(streaming=False, callbacks=[])
+    try:
+        # Guard stdout in case a legacy constructor callback still streams
+        # partial JSON tokens even with an empty per-call callback list.
         with redirect_stdout(io.StringIO()):
             response = await silent_llm.ainvoke(prompt)
-        content = response.content if hasattr(response, "content") else str(response)
-        return content.strip()
-    except Exception as exc:  # noqa: BLE001 — never let one page break the pass
-        logger.warning("Relationship LLM call failed: %s", exc)
-        return ""
+    except Exception as exc:  # noqa: BLE001 — surface as a typed failure
+        raise RelationshipLLMCallError(str(exc)) from exc
+    content = response.content if hasattr(response, "content") else str(response)
+    return content.strip()
 
 
 async def extract_relationships_for_page(
@@ -192,9 +290,25 @@ async def extract_relationships_for_page(
         for i, e in enumerate(trimmed)
     )
     content = page_text[:max_chunk_chars]
-    prompt = _PROMPT_TEMPLATE.format(entities=entity_lines, content=content)
+    prompt = _PROMPT_TEMPLATE.format(
+        entities=entity_lines,
+        content=content,
+        compatibility_guide=_COMPATIBILITY_GUIDE,
+    )
 
-    raw = await _invoke_llm(prompt, llm)
+    try:
+        raw = await _invoke_llm(prompt, llm)
+    except RelationshipLLMCallError as exc:
+        # The LLM call itself failed — this is NOT the same as the LLM running
+        # successfully and finding no relationship.  Log loudly so a broken
+        # integration is visible in normal operation instead of silently
+        # degrading every page to zero typed relationships.
+        logger.warning(
+            "Relationship extraction: LLM call FAILED (%s) — this page yielded "
+            "NO typed relationships due to an error, not because none exist",
+            exc,
+        )
+        return []
     rels = _parse_relationship_json(raw)
     if not rels:
         return []
@@ -227,6 +341,12 @@ async def extract_relationships_for_page(
             # its plain co-occurrence edge, generated elsewhere.
             continue
 
+        if not _is_compatible_relationship(rel_type, a_ent, b_ent):
+            # Structural validation is independent of the model's claim.  Do
+            # not downgrade invalid pairs to co-occurrence: the pair may be
+            # spurious even though both entities appeared on the page.
+            continue
+
         a_id = a_ent.get("id")
         b_id = b_ent.get("id")
         if not a_id or not b_id or a_id == b_id:

{voidaccess-1.8.0 → voidaccess-1.8.2}/graph/model.py

@@ -77,7 +77,7 @@ class EDGE_TYPES:
     POSTED_BY = "POSTED_BY"                     # content attributed to a handle
     LINKED_TO = "LINKED_TO"                     # URL links to URL
     MEMBER_OF = "MEMBER_OF"                     # handle to group/forum
-    USED = "USED"                               # actor used a malware family
+    USES = "USES"                               # actor uses a malware family
     CLAIMED = "CLAIMED"                         # group claimed an attack
     LIKELY_SAME_ACTOR = "LIKELY_SAME_ACTOR"     # inferred, medium confidence
     CONFIRMED_SAME_ACTOR = "CONFIRMED_SAME_ACTOR"  # PGP key match, high confidence

{voidaccess-1.8.0 → voidaccess-1.8.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "voidaccess"
-version = "1.8.0"
+version = "1.8.2"
 description = "Dark web OSINT CLI — automated threat intelligence from query to report"
 readme = "README.md"
 license = "MIT"

{voidaccess-1.8.0 → voidaccess-1.8.2}/sources/enrichment.py

@@ -565,6 +565,42 @@ def abusech_to_pages(
 _RANSOMWARE_LIVE_BASE = "https://api.ransomware.live/v2"
 _RANSOMWARE_LIVE_HEADERS = {"User-Agent": "VoidAccess-OSINT/1.0", "Accept": "application/json"}
 
+# Generic words that carry no group-identity signal in a realistic analyst
+# query ("LockBit ransomware leak site").  Stripped before matching so the
+# meaningful token(s) — e.g. "lockbit" — are what we match on, rather than
+# requiring the whole query string to appear literally in a group name.
+_GROUP_QUERY_STOPWORDS: frozenset[str] = frozenset({
+    "ransomware", "ransom", "group", "gang", "crew", "team",
+    "leak", "leaks", "leaksite", "site", "blog", "portal",
+    "data", "the", "and", "actor", "threat", "malware",
+})
+
+
+def _significant_group_tokens(query: str) -> list[str]:
+    """Meaningful lowercase tokens from a group query, stopwords removed.
+
+    Falls back to all tokens if every token was a stopword, so a query made
+    entirely of generic words still matches on something rather than nothing.
+    """
+    tokens = re.findall(r"[a-z0-9.]+", (query or "").lower())
+    tokens = [t.strip(".") for t in tokens if t.strip(".")]
+    significant = [t for t in tokens if t not in _GROUP_QUERY_STOPWORDS and len(t) >= 3]
+    return significant or tokens
+
+
+def _group_name_matches_query(name: str, tokens: list[str]) -> bool:
+    """Token-based match of a tracked group name against query tokens.
+
+    A token matches if it is a substring of the group name (so ``lockbit``
+    matches ``lockbit``, ``lockbit2``, ``lockbit3``) or the group name is a
+    substring of the token.  This is how an analyst actually phrases a query,
+    versus the old "entire query string must appear in the name" rule.
+    """
+    n = (name or "").lower()
+    if not n:
+        return False
+    return any(t and (t in n or n in t) for t in tokens)
+
 
 def _rl_extract_onion_urls(group: dict) -> list[str]:
     """Extract .onion leak-site URLs from a group dict (available sites first)."""
@@ -609,10 +645,11 @@ async def fetch_ransomware_live(query: str) -> list[dict]:
                     return []
                 all_groups = await resp.json(content_type=None)
 
+            _tokens = _significant_group_tokens(query)
             matched_summary: list[dict] = []
             for g in (all_groups if isinstance(all_groups, list) else []):
                 name = (g.get("name") or "").lower()
-                if q in name:
+                if _group_name_matches_query(name, _tokens):
                     matched_summary.append(g)
 
             if not matched_summary:
@@ -904,7 +941,8 @@ async def fetch_ransomlook(query: str) -> list[dict]:
                 all_groups = await resp.json(content_type=None)
 
             group_names = [g for g in all_groups if isinstance(g, str)] if isinstance(all_groups, list) else []
-            matched = [name for name in group_names if q in name.lower()]
+            _tokens = _significant_group_tokens(query)
+            matched = [name for name in group_names if _group_name_matches_query(name, _tokens)]
 
             if not matched:
                 logger.info("ransomlook.io: no groups matched %r", query)

{voidaccess-1.8.0 → voidaccess-1.8.2}/tests/test_db.py

@@ -395,7 +395,7 @@ class TestEntityRelationship:
         rel = EntityRelationship(
             entity_a_id=e1.id,
             entity_b_id=e2.id,
-            relationship_type=RelationshipType.USED.value,
+            relationship_type=RelationshipType.USES.value,
             source_page_id=page.id,
             confidence=0.85,
         )
@@ -404,7 +404,7 @@ class TestEntityRelationship:
 
         assert rel.id is not None
         assert rel.confidence == 0.85
-        assert rel.relationship_type == "USED"
+        assert rel.relationship_type == "USES"
 
     def test_bidirectional_orm_access(self, session):
         from db.models import EntityRelationship
@@ -788,12 +788,12 @@ class TestQueries:
             session,
             entity_a_id=e1.id,
             entity_b_id=e2.id,
-            relationship_type="USED",
+            relationship_type="USES",
             source_page_id=page.id,
             confidence=0.9,
         )
         assert rel.id is not None
-        assert rel.relationship_type == "USED"
+        assert rel.relationship_type == "USES"
         assert rel.confidence == 0.9
 
     def test_get_relationships_for_entity(self, session):
@@ -809,7 +809,7 @@ class TestQueries:
         e2 = create_entity(session, page_id=page.id, entity_type="malware", value="Malware_Q")
         e3 = create_entity(session, page_id=page.id, entity_type="handle", value="alias_q")
 
-        create_entity_relationship(session, e1.id, e2.id, "USED", page.id)
+        create_entity_relationship(session, e1.id, e2.id, "USES", page.id)
         create_entity_relationship(session, e3.id, e1.id, "LIKELY_SAME_ACTOR", page.id)
 
         rels = get_relationships_for_entity(session, e1.id)
@@ -849,8 +849,9 @@ class TestEnums:
         from db.models import RelationshipType
         expected = {
             "CO_APPEARED_ON", "POSTED_BY", "LINKED_TO", "PAID_TO",
-            "MEMBER_OF", "USED", "CLAIMED", "LIKELY_SAME_ACTOR",
+            "MEMBER_OF", "USES", "CLAIMED", "LIKELY_SAME_ACTOR",
             "CONFIRMED_SAME_ACTOR", "FUNDED_BY", "POSSIBLE_SAME_AUTHOR",
+            "DROPS", "CONTROLS", "TARGETS", "EXPLOITS", "COMMUNICATES_WITH",
         }
         actual = {r.value for r in RelationshipType}
         assert expected == actual

{voidaccess-1.8.0 → voidaccess-1.8.2}/tests/test_graph.py

@@ -61,7 +61,7 @@ def _make_graph_with_nodes() -> nx.MultiDiGraph:
     # Edges
     g.add_edge("actor1", "wallet1", edge_type="CO_APPEARED_ON", confidence=1.0,
                source_url="http://forum1.onion/page", timestamp=now, metadata={})
-    g.add_edge("actor1", "malware1", edge_type="USED", confidence=0.9,
+    g.add_edge("actor1", "malware1", edge_type="USES", confidence=0.9,
                source_url="http://forum1.onion/page", timestamp=now, metadata={})
     g.add_edge("actor1", "forum1", edge_type="MEMBER_OF", confidence=1.0,
                source_url="", timestamp=now, metadata={})
@@ -122,7 +122,7 @@ class TestModel(unittest.TestCase):
     def test_edge_types_are_strings(self):
         et = self.m.EDGE_TYPES
         for attr in ("CO_APPEARED_ON", "POSTED_BY", "LINKED_TO", "MEMBER_OF",
-                     "USED", "CLAIMED", "LIKELY_SAME_ACTOR", "CONFIRMED_SAME_ACTOR"):
+                     "USES", "CLAIMED", "LIKELY_SAME_ACTOR", "CONFIRMED_SAME_ACTOR"):
             self.assertIsInstance(getattr(et, attr), str, msg=f"EDGE_TYPES.{attr} is not str")
 
     def test_node_types_no_duplicates(self):
@@ -138,7 +138,7 @@ class TestModel(unittest.TestCase):
         et = self.m.EDGE_TYPES
         values = [
             et.CO_APPEARED_ON, et.POSTED_BY, et.LINKED_TO, et.MEMBER_OF,
-            et.USED, et.CLAIMED, et.LIKELY_SAME_ACTOR, et.CONFIRMED_SAME_ACTOR,
+            et.USES, et.CLAIMED, et.LIKELY_SAME_ACTOR, et.CONFIRMED_SAME_ACTOR,
         ]
         self.assertEqual(len(values), len(set(values)), "Duplicate EDGE_TYPES values detected")
 
@@ -700,9 +700,9 @@ class TestQueries(unittest.TestCase):
     def test_get_neighbors_edge_type_filter(self):
         """get_neighbors with edge_type filter only traverses matching edges."""
         from graph.queries import get_neighbors
-        result = get_neighbors(self.graph, "actor1", hops=2, edge_types=["USED"])
+        result = get_neighbors(self.graph, "actor1", hops=2, edge_types=["USES"])
 
-        # Only malware1 should be reachable via USED edge
+        # Only malware1 should be reachable via USES edge
         hop1_ids = {n.node_id for n in result.get("1", [])}
         self.assertIn("malware1", hop1_ids)
         # wallet1 should NOT be in hop 1 (it's connected via CO_APPEARED_ON)

voidaccess-1.8.2/tests/test_relationship_extract.py

@@ -0,0 +1,74 @@
+import pytest
+
+from extractor.relationship_extract import (
+    _COMPATIBILITY_GUIDE,
+    extract_relationships_for_page,
+    extract_relationships_from_results,
+)
+
+
+class _Response:
+    content = '{"relationships": [{"source": 0, "target": 1, "type": "uses", "confidence": 0.9}, {"source": 0, "target": 2, "type": "uses", "confidence": 0.9}]}'
+
+
+class _LLM:
+    def __init__(self):
+        self.prompt = ""
+
+    def with_config(self, _config):
+        return self
+
+    async def ainvoke(self, prompt):
+        self.prompt = prompt
+        return _Response()
+
+
+@pytest.mark.asyncio
+async def test_prompt_contains_shared_compatibility_guide_and_invalid_pair_is_dropped():
+    llm = _LLM()
+    entities = [
+        {"id": "actor", "type": "THREAT_ACTOR_HANDLE", "value": "@actor"},
+        {"id": "tool", "type": "TOOL", "value": "Rclone"},
+        {"id": "hash", "type": "FILE_HASH_SHA256", "value": "abc"},
+    ]
+
+    relationships = await extract_relationships_for_page("actor uses rclone", entities, llm)
+
+    assert relationships == [
+        {
+            "entity_a_id": "actor",
+            "entity_b_id": "tool",
+            "relationship_type": "USES",
+            "confidence": 0.9,
+        }
+    ]
+    assert _COMPATIBILITY_GUIDE in llm.prompt
+
+
+@pytest.mark.asyncio
+async def test_relationship_provenance_uses_page_manifest_id():
+    class _Result:
+        page_url = "https://example.test/page"
+        entity_ids = ["actor", "org"]
+        entities = [
+            type("Entity", (), {"entity_type": "THREAT_ACTOR_HANDLE", "value": "@actor", "confidence": 1.0})(),
+            type("Entity", (), {"entity_type": "ORGANIZATION_NAME", "value": "Acme", "confidence": 1.0})(),
+        ]
+
+    class _TargetLLM(_LLM):
+        async def ainvoke(self, prompt):
+            self.prompt = prompt
+            return type(
+                "Response",
+                (),
+                {"content": '{"relationships": [{"source": 0, "target": 1, "type": "targets", "confidence": 0.8}]}'},
+            )()
+
+    relationships = await extract_relationships_from_results(
+        [_Result()],
+        {"https://example.test/page": "actor targets Acme"},
+        {"https://example.test/page": "page-123"},
+        _TargetLLM(),
+    )
+
+    assert relationships[0]["source_page_id"] == "page-123"

{voidaccess-1.8.0 → voidaccess-1.8.2/voidaccess.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 1.8.0
+Version: 1.8.2
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT

{voidaccess-1.8.0 → voidaccess-1.8.2}/voidaccess.egg-info/SOURCES.txt

@@ -171,6 +171,7 @@ tests/test_paste_scraper.py
 tests/test_proxy_client.py
 tests/test_ransomlook.py
 tests/test_regex_patterns.py
+tests/test_relationship_extract.py
 tests/test_rss_scraper.py
 tests/test_scrape_js.py
 tests/test_settings.py

{voidaccess-1.8.0 → voidaccess-1.8.2}/voidaccess_cli/__init__.py

@@ -1,3 +1,3 @@
 """voidaccess CLI — dark-web OSINT command-line interface."""
 
-__version__ = "1.8.0"
+__version__ = "1.8.2"