safe-chains 0.227.0

[[command]]
name = "safety"
description = "Vulnerability scanner for Python dependencies. `check` and `scan` look up installed packages or a requirements file against an advisory database (network — fetches the DB if not cached). `auth` and `firewall` are interactive / external-system flows. The diagnostic --version and --help do not contact the network. Active project on the 3.x line."
url = "https://docs.safetycli.com/"
researched_version = "safety 3.x"
bare_flags = ["--help", "--version", "-h"]
examples_safe = [
    "safety check",
    "safety check -r requirements.txt",
    "safety check --output json",
    "safety check --save-json ./safety-report.json",
    "safety check --save-html ./reports",
    "safety scan --output screen",
    "safety scan --save-as json ./scan.json",
]
examples_denied = [
    "safety check --save-json ~/.ssh/authorized_keys",
    "safety check --save-html /etc/hosts",
    "safety scan --save-as json ~/.ssh/authorized_keys",
    "safety auth",
]

[[command.sub]]
name = "check"
level = "SafeRead"
bare = true
standalone = [
    "--bare", "--continue-on-error",
    "--exit-code", "--full-report",
    "--help", "--ignore-unpinned-requirements",
    "--json", "--no-cache",
    "--policy-file", "--proxy-required",
    "--short-report",
    "-h",
]
valued = [
    "--api", "--cache",
    "--db", "--exclude", "--file",
    "--ignore", "--key",
    "--output", "--proxy-host", "--proxy-port",
    "--proxy-protocol", "--save-html", "--save-json",
    "-i", "-o", "-r",
]
write_flags = ["--save-html", "--save-json", "--output", "-o"]

[[command.sub]]
name = "scan"
level = "SafeRead"
bare = true
standalone = [
    "--apply-remediations", "--detailed-output",
    "--disable-optional-telemetry", "--help",
    "--no-fix-suggestion",
    "-h",
]
valued = [
    "--auth-type", "--key", "--output",
    "--policy-file", "--save-as",
    "--target",
]

[[command.sub]]
name = "version"
standalone = ["--help", "-h"]

[[command.sub]]
name = "help"
allow_all = true

[[command.sub]]
name = "auth"
candidate = true

[[command.sub]]
name = "firewall"
candidate = true

[[command.sub]]
name = "license"
candidate = true

[[command.sub]]
name = "configure"
candidate = true

# `--save-json`/`--save-html` are "path to where the output file will be placed" (a directory gets a
# safety-report.{json,html} inside it) — write targets, unlike `--output`, which is a
# screen|text|json|bare|html enum. Neither `check` nor `scan` takes a path POSITIONAL — every input
# is a flag (`-r`, `--target`) — so gating bare positionals as writes costs no ordinary usage and
# covers the one shape a flag map cannot: `scan --save-as <FORMAT> <PATH>`, whose write target is
# the SECOND value.
[command.path_gate]
positional = "write"
flags = { "--save-html" = "write", "--save-json" = "write" }