module Noir::CliValidation

Defined in:

cli_validation.cr

Constant Summary

ACP_KNOWN_TARGETS = ["codex", "gemini", "claude", "claude-code"] of ::String

ACP targets Noir knows how to launch. Kept in sync with LLM::ACPClient::KNOWN_TARGETS (the actual exec sink). Anything else would be run as an arbitrary local process, so a --ai-provider "acp:<cmd>" from an untrusted config file is refused here — a clean pre-flight error instead of the sink's mid-scan raise. See issue: acp arbitrary exec.

MAX_CONCURRENCY = 256

Upper bound for --concurrency. A user asking for hundreds of thousands of fibers doesn't get more throughput — it just exhausts file descriptors / sockets and can take the process down. Cap at a value far above any useful setting and warn rather than silently honoring it.

VALID_OUTPUT_FORMATS = ["plain", "yaml", "json", "jsonl", "toml", "markdown-table", "sarif", "html", "curl", "httpie", "powershell", "adb", "simctl", "oas2", "oas3", "postman", "only-url", "only-param", "only-header", "only-cookie", "only-tag", "mermaid"] of ::String

Class Method Summary

• .exit_with_error(message : String) : NoReturn
• .validate!(options : Hash(String, YAML::Any))
• .validate_acp_target!(provider : String)
• .validate_ai_native_tools_allowlist!(options : Hash(String, YAML::Any))

  --ai-native-tools-allowlist entries that don't canonicalize to a provider Noir supports for native tool-calling will never match and the feature just stays off.

• .validate_ai_provider_pair!(options : Hash(String, YAML::Any))

  --ai-provider and --ai-model need each other to take effect.

• .validate_base_paths!(options : Hash(String, YAML::Any))
• .validate_concurrency!(options : Hash(String, YAML::Any))
• .validate_config_file!(options : Hash(String, YAML::Any))

  --config-file PATH needs to exist, be a file (not a directory), and parse as a YAML mapping.

• .validate_output_format!(options : Hash(String, YAML::Any))
• .validate_output_path!(options : Hash(String, YAML::Any))
• .validate_passive_scan_paths!(options : Hash(String, YAML::Any))

  --passive-scan-path PATH accepts multiple entries (repeatable), and each must exist + be a directory — NoirPassiveScan.load_rules walks PATH/**/*.{yml,yaml} and Dir.glob silently returns zero matches for non-existent paths.

• .validate_tagger_names!(options : Hash(String, YAML::Any))
• .validate_tech_names!(options : Hash(String, YAML::Any))

  -t/--techs, --only-techs, --exclude-techs should reject unknown tech names eagerly.

• .warn_about_contradictory_probe_filters(options : Hash(String, YAML::Any))

  A value listed in both --probe-match and --probe-skip is contradictory: skip wins in the Deliver pipeline, so the matcher is silently defeated.

• .warn_about_unused_delivery_flags(options : Hash(String, YAML::Any))

  --probe-match and --probe-skip only run inside the Deliver pipeline (the code that ships endpoints to --probe / --probe-via / --export-es / --export-webhook).

Class Method Detail