Package org.egothor.methodatlas

Record Class CliConfig

java.lang.Object
java.lang.Record
org.egothor.methodatlas.CliConfig
Record Components:
outputMode - selected output mode
aiOptions - AI configuration controlling provider selection, taxonomy, limits, and timeouts
paths - root paths to scan; when empty, the current working directory is scanned
fileSuffixes - one or more filename suffixes used to select source files for scanning; a file is included if its name ends with any of the listed suffixes
testMarkers - language-neutral identifiers that mark test methods; for JVM providers these are annotation simple names (e.g. "Test", "ParameterizedTest"); for .NET providers they are attribute names; TypeScript providers typically ignore this and use function names via properties instead; when empty, each TestDiscovery provider falls back to its own built-in defaults
properties - plugin-specific key/multi-value pairs forwarded verbatim to each TestDiscovery provider; providers ignore keys they do not recognise
emitMetadata - whether to emit # key: value metadata comment lines before the CSV header
manualMode - manual AI workflow mode, or null when using automated providers
applyTags - when true, AI-generated @DisplayName and @Tag annotations are written back to the source files instead of producing a CSV/SARIF report
contentHash - when true, a SHA-256 fingerprint of each class source is included as a content_hash column in CSV/plain output and as a SARIF property
overrideFile - path to a YAML classification override file, or null when no override file is configured; overrides are applied after AI classification (or in place of it in static mode) and persist human corrections across re-runs
securityOnly - when true, only methods classified as security-relevant (via AI or override) are emitted; methods without an AI suggestion or whose suggestion has securityRelevant=false are silently dropped from the output; this flag is set automatically when OutputMode.SARIF is selected unless -include-non-security is supplied, because SARIF is consumed by security tooling that expects findings, not a full inventory
aiCacheFile - path to a MethodAtlas CSV produced by a previous scan with -content-hash -ai; when present, classes whose content_hash matches an entry in that file are classified from the cache instead of calling the AI provider; null when no cache is configured
driftDetect - when true, a tag_ai_drift column is added to CSV/plain output comparing the source-level @Tag("security") annotation against the AI security-relevance classification; values are none, tag-only, or ai-only; SARIF and GitHub Annotations always include drift when AI is enabled regardless of this flag
applyTagsFromCsvFile - path to a CSV file used as input for the -apply-tags-from-csv mode; null when the mode is not active
mismatchLimit - maximum number of mismatches allowed before the apply-tags-from-csv operation is aborted; -1 means no limit is enforced
emitSourceRoot - when true, a source_root column is added to CSV/plain output identifying which scan root each record originated from; useful in multi-root projects; has no effect on SARIF or annotations output
sarifOmitScores - when true, the interaction score and confidence percentage are omitted from SARIF result message text; use this when the consuming system already renders the properties bag; default is false (scores are embedded in messages)
minConfidence - minimum AI confidence score (inclusive) for a method to be emitted; only meaningful when -ai-confidence is enabled; the default 0.0 disables the filter entirely
emitReceipt - when true, a reproducibility receipt JSON file is written after a successful scan capturing the SHA-256 of every input that influenced the result
receiptFile - target path for the reproducibility receipt; when null, the default methodatlas-receipt.json in the current working directory is used; only honoured when emitReceipt is true
emitCoverage - when true, a control-coverage matrix is produced after the scan from the mapping supplied via coverageMappingFile
coverageFile - target path for the coverage matrix JSON; when null, the default controls-coverage.json in the current working directory is used; only honoured when emitCoverage is true
coverageMappingFile - user-authored tag→control mapping JSON file; required when emitCoverage is true
evidencePackFramework - target compliance framework token supplied to -evidence-pack; null when the evidence-pack mode is not active
evidencePackDir - output directory for the evidence pack; null means use the default (under the first scan root)
evidencePackOverwrite - when true, an existing evidence-pack directory is reused; when false, a pre-existing directory is treated as an error
evidencePackKeyringFile - ZeroEcho keyring file providing the manifest signing key (a plaintext KeyringStore, not a JDK PKCS12 keystore); null produces an unsigned pack with a stderr warning; intended for CLI use with a permission-protected file
evidencePackKeyringEnv - name of an environment variable holding the full keyring content, or null; intended for CI/CD where the keyring is delivered through a platform secret and parsed in memory so the private key never touches the runner's disk; takes precedence over evidencePackKeyringFile
evidencePackKeyAlias - keyring alias of the signing key; null uses the first alias; for hybrid signing the format is "classic/pqc"
evidencePackSignAlgo - ZeroEcho signature algorithm identifier; null derives the algorithm from the keyring entry (Ed25519 when MethodAtlas-generated); a "classic+pqc" value triggers hybrid mode
verbose - when true, emit detailed diagnostics to the progress writer; consumed by -apply-tags-from-csv to diagnose zero-update runs
promoteAi - risky, not recommended: when true, -apply-tags-from-csv fills a method's blank tags / display_name from the AI columns, writing unvalidated AI output into source; off by default (see the engine and YAML docs for the full warning)
detectSecrets - when true, enable credential detection alongside the test scan
secretsInclude - glob overriding the default file mask; null uses the default
secretsRules - custom rule catalog YAML; null uses the built-in catalog
secretsOut - output path for the secrets CSV; default methodatlas-credentials.csv
secretsSeparateLlm - when true, force a standalone triage LLM call
secretsShowValues - when true, print unmasked secret values (default: redacted)
secretsErrorThreshold - SARIF error score floor (default 0.8)
secretsWarningThreshold - SARIF warning score floor (default 0.4)
secretsMinScore - suppress findings below this score (default 0.0 = keep all)
aiCacheOut - path to write the unified AI result cache (JSON Lines) after the scan, or null to write none; pair with aiCacheFile pointing at the same path for an incremental read-update cache
public record CliConfig(org.egothor.methodatlas.emit.OutputMode outputMode, org.egothor.methodatlas.ai.AiOptions aiOptions, List<Path> paths, List<String> fileSuffixes, Set<String> testMarkers, Map<String,List<String>> properties, boolean emitMetadata, ManualMode manualMode, boolean applyTags, boolean contentHash, Path overrideFile, boolean securityOnly, Path aiCacheFile, boolean driftDetect, Path applyTagsFromCsvFile, int mismatchLimit, boolean emitSourceRoot, boolean sarifOmitScores, double minConfidence, boolean emitReceipt, Path receiptFile, boolean emitCoverage, Path coverageFile, Path coverageMappingFile, String evidencePackFramework, Path evidencePackDir, boolean evidencePackOverwrite, Path evidencePackKeyringFile, String evidencePackKeyringEnv, String evidencePackKeyAlias, String evidencePackSignAlgo, boolean verbose, boolean promoteAi, boolean detectSecrets, String secretsInclude, Path secretsRules, Path secretsOut, boolean secretsSeparateLlm, boolean secretsShowValues, double secretsErrorThreshold, double secretsWarningThreshold, double secretsMinScore, Path aiCacheOut) extends Record
Parsed command-line configuration used to drive a single application run.

Instances are created by CliArgs.parse(String...) and consumed by MethodAtlasApp.run(String[], java.io.PrintWriter).

Since:
3.0.0

  • Constructor Details

    • CliConfig

      public CliConfig(org.egothor.methodatlas.emit.OutputMode outputMode, org.egothor.methodatlas.ai.AiOptions aiOptions, List<Path> paths, List<String> fileSuffixes, Set<String> testMarkers, Map<String,List<String>> properties, boolean emitMetadata, ManualMode manualMode, boolean applyTags, boolean contentHash, Path overrideFile, boolean securityOnly, Path aiCacheFile, boolean driftDetect, Path applyTagsFromCsvFile, int mismatchLimit, boolean emitSourceRoot, boolean sarifOmitScores, double minConfidence, boolean emitReceipt, Path receiptFile, boolean emitCoverage, Path coverageFile, Path coverageMappingFile, String evidencePackFramework, Path evidencePackDir, boolean evidencePackOverwrite, Path evidencePackKeyringFile, String evidencePackKeyringEnv, String evidencePackKeyAlias, String evidencePackSignAlgo, boolean verbose, boolean promoteAi, boolean detectSecrets, String secretsInclude, Path secretsRules, Path secretsOut, boolean secretsSeparateLlm, boolean secretsShowValues, double secretsErrorThreshold, double secretsWarningThreshold, double secretsMinScore, Path aiCacheOut)
      Creates an instance of a CliConfig record class.
      Parameters:
      outputMode - the value for the outputMode record component
      aiOptions - the value for the aiOptions record component
      paths - the value for the paths record component
      fileSuffixes - the value for the fileSuffixes record component
      testMarkers - the value for the testMarkers record component
      properties - the value for the properties record component
      emitMetadata - the value for the emitMetadata record component
      manualMode - the value for the manualMode record component
      applyTags - the value for the applyTags record component
      contentHash - the value for the contentHash record component
      overrideFile - the value for the overrideFile record component
      securityOnly - the value for the securityOnly record component
      aiCacheFile - the value for the aiCacheFile record component
      driftDetect - the value for the driftDetect record component
      applyTagsFromCsvFile - the value for the applyTagsFromCsvFile record component
      mismatchLimit - the value for the mismatchLimit record component
      emitSourceRoot - the value for the emitSourceRoot record component
      sarifOmitScores - the value for the sarifOmitScores record component
      minConfidence - the value for the minConfidence record component
      emitReceipt - the value for the emitReceipt record component
      receiptFile - the value for the receiptFile record component
      emitCoverage - the value for the emitCoverage record component
      coverageFile - the value for the coverageFile record component
      coverageMappingFile - the value for the coverageMappingFile record component
      evidencePackFramework - the value for the evidencePackFramework record component
      evidencePackDir - the value for the evidencePackDir record component
      evidencePackOverwrite - the value for the evidencePackOverwrite record component
      evidencePackKeyringFile - the value for the evidencePackKeyringFile record component
      evidencePackKeyringEnv - the value for the evidencePackKeyringEnv record component
      evidencePackKeyAlias - the value for the evidencePackKeyAlias record component
      evidencePackSignAlgo - the value for the evidencePackSignAlgo record component
      verbose - the value for the verbose record component
      promoteAi - the value for the promoteAi record component
      detectSecrets - the value for the detectSecrets record component
      secretsInclude - the value for the secretsInclude record component
      secretsRules - the value for the secretsRules record component
      secretsOut - the value for the secretsOut record component
      secretsSeparateLlm - the value for the secretsSeparateLlm record component
      secretsShowValues - the value for the secretsShowValues record component
      secretsErrorThreshold - the value for the secretsErrorThreshold record component
      secretsWarningThreshold - the value for the secretsWarningThreshold record component
      secretsMinScore - the value for the secretsMinScore record component
      aiCacheOut - the value for the aiCacheOut record component

  • Method Details

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. Reference components are compared with Objects::equals(Object,Object); primitive components are compared with '=='.
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • outputMode

      public org.egothor.methodatlas.emit.OutputMode outputMode()
      Returns the value of the outputMode record component.
      Returns:
      the value of the outputMode record component

    • aiOptions

      public org.egothor.methodatlas.ai.AiOptions aiOptions()
      Returns the value of the aiOptions record component.
      Returns:
      the value of the aiOptions record component

    • paths

      public List<Path> paths()
      Returns the value of the paths record component.
      Returns:
      the value of the paths record component

    • fileSuffixes

      public List<String> fileSuffixes()
      Returns the value of the fileSuffixes record component.
      Returns:
      the value of the fileSuffixes record component

    • testMarkers

      public Set<String> testMarkers()
      Returns the value of the testMarkers record component.
      Returns:
      the value of the testMarkers record component

    • properties

      public Map<String,List<String>> properties()
      Returns the value of the properties record component.
      Returns:
      the value of the properties record component

    • emitMetadata

      public boolean emitMetadata()
      Returns the value of the emitMetadata record component.
      Returns:
      the value of the emitMetadata record component

    • manualMode

      public ManualMode manualMode()
      Returns the value of the manualMode record component.
      Returns:
      the value of the manualMode record component

    • applyTags

      public boolean applyTags()
      Returns the value of the applyTags record component.
      Returns:
      the value of the applyTags record component

    • contentHash

      public boolean contentHash()
      Returns the value of the contentHash record component.
      Returns:
      the value of the contentHash record component

    • overrideFile

      public Path overrideFile()
      Returns the value of the overrideFile record component.
      Returns:
      the value of the overrideFile record component

    • securityOnly

      public boolean securityOnly()
      Returns the value of the securityOnly record component.
      Returns:
      the value of the securityOnly record component

    • aiCacheFile

      public Path aiCacheFile()
      Returns the value of the aiCacheFile record component.
      Returns:
      the value of the aiCacheFile record component

    • driftDetect

      public boolean driftDetect()
      Returns the value of the driftDetect record component.
      Returns:
      the value of the driftDetect record component

    • applyTagsFromCsvFile

      public Path applyTagsFromCsvFile()
      Returns the value of the applyTagsFromCsvFile record component.
      Returns:
      the value of the applyTagsFromCsvFile record component

    • mismatchLimit

      public int mismatchLimit()
      Returns the value of the mismatchLimit record component.
      Returns:
      the value of the mismatchLimit record component

    • emitSourceRoot

      public boolean emitSourceRoot()
      Returns the value of the emitSourceRoot record component.
      Returns:
      the value of the emitSourceRoot record component

    • sarifOmitScores

      public boolean sarifOmitScores()
      Returns the value of the sarifOmitScores record component.
      Returns:
      the value of the sarifOmitScores record component

    • minConfidence

      public double minConfidence()
      Returns the value of the minConfidence record component.
      Returns:
      the value of the minConfidence record component

    • emitReceipt

      public boolean emitReceipt()
      Returns the value of the emitReceipt record component.
      Returns:
      the value of the emitReceipt record component

    • receiptFile

      public Path receiptFile()
      Returns the value of the receiptFile record component.
      Returns:
      the value of the receiptFile record component

    • emitCoverage

      public boolean emitCoverage()
      Returns the value of the emitCoverage record component.
      Returns:
      the value of the emitCoverage record component

    • coverageFile

      public Path coverageFile()
      Returns the value of the coverageFile record component.
      Returns:
      the value of the coverageFile record component

    • coverageMappingFile

      public Path coverageMappingFile()
      Returns the value of the coverageMappingFile record component.
      Returns:
      the value of the coverageMappingFile record component

    • evidencePackFramework

      public String evidencePackFramework()
      Returns the value of the evidencePackFramework record component.
      Returns:
      the value of the evidencePackFramework record component

    • evidencePackDir

      public Path evidencePackDir()
      Returns the value of the evidencePackDir record component.
      Returns:
      the value of the evidencePackDir record component

    • evidencePackOverwrite

      public boolean evidencePackOverwrite()
      Returns the value of the evidencePackOverwrite record component.
      Returns:
      the value of the evidencePackOverwrite record component

    • evidencePackKeyringFile

      public Path evidencePackKeyringFile()
      Returns the value of the evidencePackKeyringFile record component.
      Returns:
      the value of the evidencePackKeyringFile record component

    • evidencePackKeyringEnv

      public String evidencePackKeyringEnv()
      Returns the value of the evidencePackKeyringEnv record component.
      Returns:
      the value of the evidencePackKeyringEnv record component

    • evidencePackKeyAlias

      public String evidencePackKeyAlias()
      Returns the value of the evidencePackKeyAlias record component.
      Returns:
      the value of the evidencePackKeyAlias record component

    • evidencePackSignAlgo

      public String evidencePackSignAlgo()
      Returns the value of the evidencePackSignAlgo record component.
      Returns:
      the value of the evidencePackSignAlgo record component

    • verbose

      public boolean verbose()
      Returns the value of the verbose record component.
      Returns:
      the value of the verbose record component

    • promoteAi

      public boolean promoteAi()
      Returns the value of the promoteAi record component.
      Returns:
      the value of the promoteAi record component

    • detectSecrets

      public boolean detectSecrets()
      Returns the value of the detectSecrets record component.
      Returns:
      the value of the detectSecrets record component

    • secretsInclude

      public String secretsInclude()
      Returns the value of the secretsInclude record component.
      Returns:
      the value of the secretsInclude record component

    • secretsRules

      public Path secretsRules()
      Returns the value of the secretsRules record component.
      Returns:
      the value of the secretsRules record component

    • secretsOut

      public Path secretsOut()
      Returns the value of the secretsOut record component.
      Returns:
      the value of the secretsOut record component

    • secretsSeparateLlm

      public boolean secretsSeparateLlm()
      Returns the value of the secretsSeparateLlm record component.
      Returns:
      the value of the secretsSeparateLlm record component

    • secretsShowValues

      public boolean secretsShowValues()
      Returns the value of the secretsShowValues record component.
      Returns:
      the value of the secretsShowValues record component

    • secretsErrorThreshold

      public double secretsErrorThreshold()
      Returns the value of the secretsErrorThreshold record component.
      Returns:
      the value of the secretsErrorThreshold record component

    • secretsWarningThreshold

      public double secretsWarningThreshold()
      Returns the value of the secretsWarningThreshold record component.
      Returns:
      the value of the secretsWarningThreshold record component

    • secretsMinScore

      public double secretsMinScore()
      Returns the value of the secretsMinScore record component.
      Returns:
      the value of the secretsMinScore record component

    • aiCacheOut

      public Path aiCacheOut()
      Returns the value of the aiCacheOut record component.
      Returns:
      the value of the aiCacheOut record component