PromptshieldCliOptions

Defined in: main.ts:85

CLI options for the PromptShield command-line interface.

This interface represents the normalized, programmatic shape of user-provided CLI flags after argument parsing.

Notes:

• All properties are optional to allow layered configuration (defaults → config file → CLI flags).
• Final effective values are resolved by the CLI bootstrap layer.

Properties

cacheMode?

Defined in: main.ts:216

Cache storage strategy.

• "none" → disable persistent cache
• "single" → one cache.json file
• "split" → per-file hashed cache entries
• "auto" → strategy selected via repository size heuristic

When enabled (cacheMode !== "none"), cache stores baseline filtered results computed using:

• minSeverity: "LOW"
• inline ignore directives enabled

Severity filtering and noInlineIgnore are applied after cache retrieval.

Default

"auto"

check?

Defined in: main.ts:185

CI enforcement mode.

When enabled:

• Process exits with non-zero status if threats are detected.
• Designed for pipeline gating and automated checks.

May implicitly adjust other defaults (e.g., disable inline ignores).

Default

false

command?

Defined in: main.ts:107

CLI command to execute.

• "scan" → analyze files and report threats.
• "fix" → scan and apply automatic fixes where possible.
• "sanitize" → transform input defensively (may be stricter than fix).

Default

"scan"

forceFullScan?

Defined in: main.ts:225

Forces a full rescan of all files and refreshes cache entries.

Ignored when cacheMode === "none".

Default

false

json?

Defined in: main.ts:146

Emit structured JSON output instead of human-readable logs.

Intended for:

• CI pipelines
• Machine consumption
• Automated tooling integrations

When enabled:

• Console formatting is suppressed
• Output is deterministic and parseable

Default

false

logLevel?

Defined in: main.ts:96

Logging verbosity level.

Controls console output granularity. Higher verbosity provides additional diagnostic context.

When json is enabled, log output is suppressed regardless of this value.

Default

"info"

minSeverity?

Defined in: main.ts:120

Minimum severity threshold to report.

Only threats with severity greater than or equal to this level are included in output.

When caching is enabled, baseline scans may still run at a lower severity internally to preserve correctness.

Default

"LOW"

noInlineIgnore?

Defined in: main.ts:196

Disable inline ignore directives (e.g., // promptshield-ignore).

When enabled:

• All rules are evaluated without honoring in-source suppression.
• Useful for CI audits or security reviews.

Default

true if CI environment is detected

patterns?

Defined in: main.ts:130

Glob patterns specifying files to process.

Patterns are resolved relative to the current working directory.

If omitted, the CLI may fallback to a default pattern set (e.g., ["** /*"] or project-configured values).

report?

Defined in: main.ts:232

Generate a detailed Markdown workspace report describing found threats.

Default

false

strict?

Defined in: main.ts:159

Enable strict sanitization mode.

In strict mode:

• Potentially unsafe constructs may be rejected rather than fixed.
• Heuristics are minimized in favor of explicit safety guarantees.

Intended for high-security or CI enforcement workflows.

Default

false

write?

Defined in: main.ts:172

Persist modifications to disk.

When enabled:

• Fix or sanitize operations write changes to files.
• When disabled, operations run in dry-run mode.

Ignored for pure scan commands.

Default

false