Skip to content

fix: default parse --level to reachable to match scan and Python CLI - #35

Merged
ar7casper merged 4 commits into
knostic:release/2026-05-12from
joshbouncesecurity:fix/issue16-04-parse-level
May 12, 2026
Merged

fix: default parse --level to reachable to match scan and Python CLI#35
ar7casper merged 4 commits into
knostic:release/2026-05-12from
joshbouncesecurity:fix/issue16-04-parse-level

Conversation

@joshbouncesecurity

Copy link
Copy Markdown
Contributor

@

Summary

The Go CLI parse command defaults --level to "all", while both scan and the Python CLI default to "reachable". This means standalone openant parse produces a different (larger, noisier) dataset than openant scan, with no indication to the user.

This change flips parse's default to "reachable" so the three entry points stay consistent.

Addresses item 4 from #16 (does not close the issue).

Test plan

  • openant parse <repo> writes the same set of nodes as openant scan <repo> --steps parse.
  • openant parse <repo> --level all still produces the larger dataset.
    @

The Go CLI parse command defaulted --level to "all", skipping reachability
analysis. The scan command and the Python CLI both default to "reachable".
Align parse to match so reachability filtering runs by default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
joshbouncesecurity added 3 commits May 4, 2026 21:08
After flipping the default to reachable, the forwarding guard at
parse.go was still 'parseLevel != "all"', which silently dropped
'--level all' (the user's explicit non-default choice) and let the
Python CLI fall back to its own default of reachable. Compare against
the new default so all four choices are forwarded faithfully and the
behavior matches scan.go.
Pulls the Python argv assembly out of runParse into buildParsePyArgs
so the forwarding rules (omit defaults, pass non-defaults through)
can be tested directly. Adds cases for every --level choice plus a
baseline that pins the full argv shape, and a usage-string check that
asserts all four documented choices appear in --help.
@joshbouncesecurity

Copy link
Copy Markdown
Contributor Author

Manual verification

In addition to the new automated tests:

  • openant parse <repo> (no --level flag): output matches openant scan <repo> --steps parse (same node count). Previously parse produced a larger dataset.
  • openant parse <repo> --level all: dataset is larger (compare wc -l dataset.json against the no-flag run).
  • openant parse --help: confirm --level shows (default "reachable").
  • openant parse <repo> --level codeql and --level exploitable: the explicit flag is forwarded to the Python CLI (was silently dropped in an earlier draft of this PR; now fixed).

@joshbouncesecurity

Copy link
Copy Markdown
Contributor Author

Local test results

Built the Go CLI from this branch and verified the help text on Windows.

Commands run:

cd .worktrees/fix/issue16-04-parse-level/apps/openant-cli
go build -o openant.exe ./
./openant.exe parse --help

Result (relevant flag):

      --level string        Processing level: all, reachable, codeql, exploitable (default "reachable")

Outcome:

  • openant parse --help shows (default "reachable")

Did not run the full parse-vs-scan parity comparison in this pass (that's well-covered by the automated test in the diff), but the user-facing default is now correctly flipped.

@ar7casper ar7casper left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch

@ar7casper
ar7casper changed the base branch from master to release/2026-05-12 May 12, 2026 06:48
@joshbouncesecurity
joshbouncesecurity marked this pull request as ready for review May 12, 2026 07:00
@ar7casper
ar7casper merged commit 21cd56f into knostic:release/2026-05-12 May 12, 2026
8 checks passed
@ar7casper ar7casper mentioned this pull request May 12, 2026
3 tasks
ar7casper added a commit that referenced this pull request May 13, 2026
Covers the seven PRs in this release:
- #35: parse --level default → reachable (CLI consistency with scan + Python CLI)
- #36: auto-detect dep changes via ~/.openant/venv/.deps-hash
- #37: lazy JS parser npm bootstrap on first use
- #39: TypeScript/NestJS DI-aware call resolution (constructor + field + functional inject())
- #40: --language auto opt-in for openant init + non-git path support + shared config/languages.json
- #49: Express anonymous route handler extraction (route_handler / route_middleware)
- #50: --llm-reachability opt-in stage + cross-parser call_graph.json contract

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants