1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
use clap::Parser;
use std::path::PathBuf;
/// Arguments for `keyhog install` (compile and publish execution packs for the local host).
#[derive(Parser, Debug, Clone, Default)]
pub struct InstallArgs {
/// Reinstall even if execution packs are already present and valid.
#[arg(long)]
pub force: bool,
}
#[derive(Parser)]
pub struct CompileExecutionPacksArgs {
/// Publish the complete immutable execution-pack generation here.
#[arg(long, value_name = "DIR")]
pub output_dir: PathBuf,
/// Read the exact 32-byte installation signing key from this regular file.
#[arg(long, value_name = "PATH")]
pub signing_key: PathBuf,
}
#[derive(Parser)]
pub struct CompileGpuLiteralsArgs {
/// Publish the compiled GPU literal matcher artifacts here. Defaults to the
/// host runtime program cache the scanner loads them from.
#[arg(long, value_name = "DIR")]
pub output_dir: Option<PathBuf>,
}
#[derive(Parser)]
pub struct CompletionArgs {
/// Shell to generate completions for.
#[arg(value_enum)]
pub shell: clap_complete::Shell,
}
#[derive(Parser)]
// `--json` renders either the self-test report or the autoroute-cache inspection,
// so it requires one of them; the two modes are mutually exclusive.
#[command(group(clap::ArgGroup::new("json_target").args(["self_test", "autoroute"])))]
pub struct BackendArgs {
/// Probe the workload size in the diagnostic hardware heuristic matrix.
/// This does not predict `scan --backend auto`, which uses persisted
/// fastest-correct calibration evidence.
#[arg(long)]
pub probe_bytes: Option<u64>,
/// Inspect the persisted autoroute calibration cache: which resolved scan
/// configs and workload buckets have a fastest-correct backend decision,
/// the cold-aware one-shot and warm-daemon routes, confidence basis, and
/// whether the cache is stale for this build. Read-only; pairs with
/// `--json`. Use this to diagnose an "autoroute calibration required"
/// routing error and identify the exact unproved workload bucket.
#[arg(long)]
pub autoroute: bool,
/// Include every workload decision and parity receipt in human-readable
/// autoroute inspection. The default view is a concise health and route
/// summary; `--json` remains the complete machine-readable representation.
#[arg(long, requires = "autoroute")]
pub verbose: bool,
/// Inspect this explicit autoroute cache file instead of the platform
/// default. Use the same absolute path passed to `scan --autoroute-cache`
/// or configured as `[system].autoroute_cache`; `off` inspects the disabled
/// state.
#[arg(long, value_name = "PATH|off", requires = "autoroute")]
pub autoroute_cache: Option<String>,
/// Compiled pattern count to use for the routing-simulation matrix.
/// This is a what-if knob: it does not change the loaded corpus, only
/// the pattern_count fed to the backend-routing thresholds so you can
/// probe how a larger/smaller corpus would route. Omit it to use the live
/// compiled embedded corpus.
#[arg(long)]
pub patterns: Option<usize>,
/// Run the GPU self-tests (MoE compute kernel + VYRE direct-match
/// diagnostic + production region-presence dispatch). Prints PASS/FAIL
/// with adapter info and exits with code 4 on failure so CI can
/// gate a release on real GPU functionality. Reports SKIP and exits zero
/// without a non-software adapter unless --require-gpu is set.
#[arg(long)]
pub self_test: bool,
/// Emit `backend --self-test` or `backend --autoroute` as stable JSON for
/// CI health gates / scripted inspection.
#[arg(long, requires = "json_target")]
pub json: bool,
/// Disable GPU probing for backend inspection/self-test.
#[arg(long, conflicts_with = "require_gpu")]
pub no_gpu: bool,
/// Fail closed when backend self-test cannot use a real GPU.
#[arg(long, conflicts_with = "no_gpu")]
pub require_gpu: bool,
}
/// Arguments for `keyhog doctor`.
#[derive(Parser)]
pub struct DoctorArgs {
/// Read a `bloom-evidence-v1` receipt produced by `keyhog bloom-diagnostic`.
/// The receipt must match this binary's detector corpus and prove exact
/// enabled-versus-bypassed finding parity.
#[arg(long, value_name = "PATH")]
pub bloom_evidence: Option<PathBuf>,
/// Inspect this explicit autoroute cache file instead of the platform
/// default. Use the same absolute path passed to `scan --autoroute-cache`
/// or configured as `[system].autoroute_cache`; `off` inspects the disabled
/// state. Without it, doctor reports the platform-default cache, which is
/// not the file a project-configured scan uses.
#[arg(long, value_name = "PATH|off")]
pub autoroute_cache: Option<String>,
}
/// Arguments for `keyhog uninstall`.
#[derive(Parser)]
pub struct UninstallArgs {
/// Actually remove the binary. Without this, uninstall is a safe dry run
/// that only reports what would be removed.
#[arg(long)]
pub yes: bool,
}