module
Noir::CLI::ScanCommand
Overview
noir scan [paths...] [flags]
Discovers endpoints across one or more code bases. Positional paths
augment any -b PATH flags so both v0 and v1 invocation styles work:
noir scan ./app # v1 positional noir scan ./api ./worker # v1 multi-path positional noir -b ./app # v0 (router default-routes to scan) noir scan -b ./app --passive # v1 explicit + flags
Defined in:
cli/commands/scan.crConstant Summary
-
PROMPT_OVERRIDE_SETTERS =
{"override_filter_prompt" => ->(v : String) do LLM::PromptOverrides.filter_prompt = v end, "override_analyze_prompt" => ->(v : String) do LLM::PromptOverrides.analyze_prompt = v end, "override_bundle_analyze_prompt" => ->(v : String) do LLM::PromptOverrides.bundle_analyze_prompt = v end, "override_llm_optimize_prompt" => ->(v : String) do LLM::PromptOverrides.llm_optimize_prompt = v end} -
STRUCTURED_OUTPUT_FORMATS =
Set {"json", "yaml", "jsonl", "toml", "sarif", "oas2", "oas3", "postman", "html", "mermaid", "markdown-table"} -
Output formats whose downstream consumers (jq, SARIF parsers, Swagger/ Postman importers, CI report uploaders/archivers) treat empty or missing output as a hard error. When a scan finds no endpoints, we still emit a valid empty document for these formats —
{"endpoints":[],"passive_ results":[]}for json, a"paths": {}OAS document, a header-only Markdown table, an empty-mindmap Mermaid diagram, a full HTML shell, etc. Every format below already produces a well-formed document for zero endpoints (verified), so this is purely about not skipping the builder call entirely.Command-list / line-list formats (curl, httpie, powershell, adb, simctl, only-*) and
plainare deliberately excluded: they have no envelope, so "nothing to render" is the correct empty output for them. -
WARNING_COLOR =
Colorize::Color256.new(208) -
ANSI 256-color orange used for the protocol-missing warning. Kept as a named constant so the call site reads as "warning color" rather than a bare magic number.