voidaccess 2.0.1__tar.gz → 2.0.2__tar.gz

{voidaccess-2.0.1 → voidaccess-2.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 2.0.1
+Version: 2.0.2
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT

{voidaccess-2.0.1 → voidaccess-2.0.2}/api/main.py

@@ -332,7 +332,7 @@ async def _periodic_stuck_sweep() -> None:
 app = FastAPI(
     title="VoidAccess Intelligence API",
     description="VoidAccess: Dark Web Intelligence Platform",
-    version="2.0.1",
+    version="2.0.2",
     docs_url="/docs",
     redoc_url="/redoc",
     lifespan=lifespan,

{voidaccess-2.0.1 → voidaccess-2.0.2}/export/__init__.py

@@ -17,6 +17,7 @@ from export.misp import (
 from export.sigma import (
     entities_to_sigma_rules,
     export_sigma_rules,
+    render_sigma_rules,
     sigma_rule_to_yaml,
 )
 from export.yara_export import (
@@ -44,6 +45,7 @@ __all__ = [
     # sigma
     "entities_to_sigma_rules",
     "sigma_rule_to_yaml",
+    "render_sigma_rules",
     "export_sigma_rules",
     # yara
     "generate_yara_rules",

{voidaccess-2.0.1 → voidaccess-2.0.2}/export/ioc_package.py

@@ -57,7 +57,7 @@ logger = logging.getLogger(__name__)
 # ---------------------------------------------------------------------------
 
 PACKAGE_FORMAT = "voidaccess-ioc-v1"
-PACKAGE_VERSION = "2.0.1"
+PACKAGE_VERSION = "2.0.2"
 SNORT_SID_BASE = 9000001  # 9xxxxxx reserved for VoidAccess-generated rules
 
 # Map extractor upper-case entity types to the per-file bucket they belong to.
@@ -702,57 +702,13 @@ def _safe_misp_json(entities: list[Any], investigation_id: Any) -> str:
 
 def _safe_sigma_yml(entities: list[Any]) -> str:
     try:
-        from export.sigma import entities_to_sigma_rules, sigma_rule_to_yaml
-        # Sigma rules expect object-style entities (NormalizedEntity).  When the
-        # caller passes plain dicts, wrap them in a tiny adapter so Sigma can
-        # read .entity_type, .value, .confidence, and .source_url.
-        adapted: list[Any] = []
-        for e in entities or []:
-            if isinstance(e, dict):
-                adapted.append(_DictEntityAdapter(e))
-            else:
-                adapted.append(e)
-        rules = entities_to_sigma_rules(adapted)
-        return "\n---\n".join(sigma_rule_to_yaml(r) for r in rules if r)
+        from export.sigma import render_sigma_rules
+        return render_sigma_rules(entities or [])
     except Exception as exc:
         logger.warning("Sigma generation for IOC package failed: %s", exc)
         return ""
 
 
-class _DictEntityAdapter:
-    """Adapt a plain dict into an object with .entity_type / .value / etc.
-
-    Used to feed dict-shaped entities into Sigma / STIX / MISP generators
-    that expect object access.  Keeps the IOC package module standalone
-    without changing the existing Sigma / STIX / MISP module signatures.
-    """
-
-    __slots__ = ("_d",)
-
-    def __init__(self, d: dict[str, Any]) -> None:
-        self._d = d
-
-    @property
-    def entity_type(self) -> str:
-        return _entity_type(self._d)
-
-    @property
-    def value(self) -> str:
-        return _entity_value(self._d)
-
-    @property
-    def canonical_value(self) -> str:
-        return entity_canonical_id(self._d)
-
-    @property
-    def confidence(self) -> float:
-        return _entity_confidence(self._d)
-
-    @property
-    def source_url(self) -> str:
-        return _entity_source_url(self._d)
-
-
 # ---------------------------------------------------------------------------
 # README + metadata builders
 # ---------------------------------------------------------------------------

{voidaccess-2.0.1 → voidaccess-2.0.2}/export/sigma.py

@@ -207,7 +207,8 @@ def entities_to_sigma_rules(
     Falls back to base rule if LLM fails.
     """
     rules: list[dict] = []
-    for entity in entities:
+    for raw_entity in entities:
+        entity = _adapt_entity(raw_entity)
         if entity.entity_type not in _SIGMA_ENTITY_TYPES:
             continue
         base = _build_base_rule(entity)
@@ -228,6 +229,23 @@ def sigma_rule_to_yaml(rule: dict) -> str:
         return ""
 
 
+def render_sigma_rules(
+    entities: list[Any],
+    llm: Optional[Any] = None,
+) -> str:
+    """Render the shared Sigma artifact used by every export surface.
+
+    The CLI export and the IOC package both receive the same export payload,
+    whose entities are normally dictionaries.  Keeping adaptation, rule
+    generation, and YAML assembly here prevents one surface from growing a
+    second DB-loading implementation with different failure semantics.
+    """
+    rules = entities_to_sigma_rules(list(entities or []), llm=llm)
+    return "\n---\n".join(
+        sigma_rule_to_yaml(rule) for rule in rules if rule
+    )
+
+
 def export_sigma_rules(
     investigation_id: Any,
     output_dir: str,
@@ -320,6 +338,45 @@ def _load_entities_for_investigation(investigation_id: Any) -> list[Any]:
         return []
 
 
+class _DictEntityAdapter:
+    """Expose dictionary-shaped export entities through Sigma's object API."""
+
+    __slots__ = ("_data",)
+
+    def __init__(self, data: dict[str, Any]) -> None:
+        self._data = data
+
+    @property
+    def entity_type(self) -> str:
+        return str(self._data.get("entity_type") or "")
+
+    @property
+    def value(self) -> str:
+        return str(
+            self._data.get("canonical_value")
+            or self._data.get("value")
+            or ""
+        )
+
+    @property
+    def confidence(self) -> float:
+        try:
+            return float(self._data.get("confidence", 0.0) or 0.0)
+        except (TypeError, ValueError):
+            return 0.0
+
+    @property
+    def source_url(self) -> str:
+        return str(self._data.get("source_url") or "")
+
+
+def _adapt_entity(entity: Any) -> Any:
+    """Accept both ORM/normalized entities and export dictionaries."""
+    if isinstance(entity, dict):
+        return _DictEntityAdapter(entity)
+    return entity
+
+
 def _coerce_uuid(value: Any):
     """Coerce value to uuid.UUID. Returns None on failure."""
     import uuid as _uuid

{voidaccess-2.0.1 → voidaccess-2.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "voidaccess"
-version = "2.0.1"
+version = "2.0.2"
 description = "Dark web OSINT CLI — automated threat intelligence from query to report"
 readme = "README.md"
 license = "MIT"
@@ -154,7 +154,7 @@ exclude = [
 "sources" = ["data/onion_seeds.json"]
 "sources.data" = ["onion_seeds.json"]
 
-# v2.0.1 — ship the top-level reference data bundle inside the installed
+# v2.0.2 — ship the top-level reference data bundle inside the installed
 # package.  The runtime resolves each of these via
 # ``os.path.dirname(os.path.dirname(__file__))/data`` (from extractor/ and
 # monitor/), i.e. ``site-packages/data/<file>`` after a wheel install.  The

{voidaccess-2.0.1 → voidaccess-2.0.2}/voidaccess.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 2.0.1
+Version: 2.0.2
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT

{voidaccess-2.0.1 → voidaccess-2.0.2}/voidaccess_cli/__init__.py

@@ -1,3 +1,3 @@
 """voidaccess CLI — dark-web OSINT command-line interface."""
 
-__version__ = "2.0.1"
+__version__ = "2.0.2"

{voidaccess-2.0.1 → voidaccess-2.0.2}/voidaccess_cli/commands/export.py

@@ -11,7 +11,6 @@ import csv
 import io
 import json
 import re as _re
-import tempfile
 import uuid
 from pathlib import Path
 from typing import Optional
@@ -83,7 +82,10 @@ def run(
         include_raw=include_raw,
     )
     out_path = output or _default_out_path(
-        target, suffix, fmt=fmt, query=(data.get("investigation") or {}).get("query")
+        target,
+        suffix,
+        fmt=fmt,
+        query=_investigation_metadata(data, inv_id).get("query"),
     )
     out_path = Path(out_path).expanduser()
     if out_path.exists():
@@ -122,8 +124,23 @@ def _load_target(target: str) -> tuple[Optional[str], Optional[dict]]:
         return inv_id, data
     from voidaccess_cli.adapters import sqlite as sqlite_adapter
     sqlite_adapter.init_db()
-    resolved = sqlite_adapter.resolve_investigation_id(target) or target
-    data = sqlite_adapter.investigation_to_export_dict(resolved)
+    try:
+        resolved = sqlite_adapter.resolve_investigation_id(target) or target
+        data = sqlite_adapter.investigation_to_export_dict(resolved)
+    except Exception as exc:
+        # Do not let an ORM/SQLAlchemy read failure become an empty export.
+        # init_db() is the schema choke-point; this guard covers a schema
+        # mismatch that manifests while loading a table/column not included in
+        # the lightweight preflight contract.  Rendering happens only after
+        # this function returns, so no artifact can be written on failure.
+        from sqlalchemy.exc import OperationalError
+
+        if isinstance(exc, OperationalError):
+            raise sqlite_adapter.DatabaseSchemaError(
+                "Export could not read the database; the schema may be stale. "
+                "Run `alembic upgrade head` and retry."
+            ) from exc
+        raise
     if not data or not data.get("investigation"):
         return None, None
     return resolved, data
@@ -193,17 +210,12 @@ def _render(
         return misp_event_to_json(event), ".json"
 
     if fmt == "sigma":
-        from export import export_sigma_rules
-        # The Sigma exporter writes one YAML file per rule and therefore needs
-        # an output directory.  The CLI itself promises one output artifact,
-        # so collect those files in a temporary directory and combine them.
-        with tempfile.TemporaryDirectory(prefix="voidaccess-sigma-") as temp_dir:
-            rule_paths = export_sigma_rules(inv_uuid, temp_dir)
-            rules_yaml = "\n---\n".join(
-                Path(rule_path).read_text(encoding="utf-8")
-                for rule_path in rule_paths
-            )
-        return rules_yaml, ".yml"
+        from export import render_sigma_rules
+        # The IOC package and direct CLI export must share the same generator.
+        # ``data`` was loaded through the CLI's init_db() choke-point above;
+        # loading the entities again through export_sigma_rules() used to
+        # create a second, error-swallowing DB path and yielded empty files.
+        return render_sigma_rules(data.get("entities") or []), ".yml"
 
     raise typer.BadParameter(f"Unknown format: {fmt}")
 
@@ -221,7 +233,7 @@ def _render_detection_rule(
     already embedded in the JSON payload so this still works when the user
     passes a ``.json`` file (the API path requires a DB investigation).
     """
-    investigation = data.get("investigation") or {}
+    investigation = _investigation_metadata(data, inv_id)
     investigation_dict: dict = {
         "id": investigation.get("id") or inv_id or "",
         "run_id": investigation.get("run_id"),
@@ -278,7 +290,7 @@ def _render_package(
     import asyncio
     from export.ioc_package import build_package_filename, generate_ioc_package
 
-    investigation = data.get("investigation") or {}
+    investigation = _investigation_metadata(data, inv_id)
     entities = data.get("entities") or []
 
     # Build the flat-shape dict the package generator expects.
@@ -309,6 +321,30 @@ def _render_package(
     return zip_bytes, suffix
 
 
+def _investigation_metadata(data: dict, inv_id: Optional[str] = None) -> dict:
+    """Return metadata from either DB-shaped or flat CLI JSON payloads."""
+    nested = data.get("investigation")
+    nested = nested if isinstance(nested, dict) else {}
+    fields = (
+        "id",
+        "run_id",
+        "query",
+        "refined_query",
+        "model_used",
+        "summary",
+        "created_at",
+        "sources_used",
+    )
+    metadata = {field: data[field] for field in fields if field in data}
+    metadata.update(nested)
+    metadata["id"] = nested.get("id") or data.get("id") or inv_id or ""
+    metadata["query"] = nested.get("query") or data.get("query") or ""
+    metadata["sources_used"] = (
+        nested.get("sources_used") or data.get("sources_used") or {}
+    )
+    return metadata
+
+
 def _csv_from_data(data: dict) -> str:
     entities = data.get("entities", [])
     if not entities and isinstance(data.get("investigation"), dict):