Open workbench
Menu

SIS CLI

Scan Configuration Guide

Use explicit options/configuration and preserve the resulting posture when comparing runs. Configuration discovery, provider availability and precedence differ by command; one flag does not establish a uniform replay contract.

Start with the build and configuration

sis doctor --json
sis config init --path config.toml
sis config verify --path config.toml --strict
sis doctor --config config.toml --json
sis scan sample.html --config config.toml --format json --emit json=report.json

config init creates a starter and refuses to overwrite an existing file. verify --strict rejects unknown TOML keys. doctor reports edition, build/schema identity and compiled optional capabilities; a provider reported unavailable did not run. Its config check checks TOML parsing, not all semantic key validity, and warnings do not make its exit nonzero. Use config verify --strict as well.

For scan, an explicit --config path wins over default lookup. Without it, lookup uses the platform configuration directory (~/.config/sis/config.toml on macOS and typical Linux systems; the platform config directory on Windows). Assessment uses an explicit --config only. doctor checks the file you name rather than automatically validating scan’s default file.

Breadth, execution permission and providers

sis scan sample.html --analysis-profile deep --dynamic-analysis-policy disabled --format json
  • quick, standard, deep and strict are analysis presets; strict includes deep breadth and strict parsing.
  • --deep remains a supported breadth flag. It does not mean every optional provider ran.
  • Dynamic policy is separately disabled, native-codecs-only (default), or sandboxed. Sandboxed permits instrumented script execution; native codecs may decode content without executing its script. The actual lane must still be selected and applicable.
  • OCR/ML and other optional providers also depend on what was compiled into the binary and on the resolved policy. Inspect doctor, provider_participation, analysis_posture and analysis_coverage; missing output is not proof that a provider found nothing.

Bound work explicitly

sis scan sample.html --max-decode-bytes 1048576 --max-total-decoded-bytes 8388608 --max-objects 10000 --max-recursion-depth 8 --format json
sis scan intake --glob '*.html' --timeout-per-file 10 --format jsonl

Decode, extraction, object, traversal and timeout limits bound different work. A refusal, failed decoder or exhausted budget is an analysis omission. Do not interpret it as content absence.

A minimal durable configuration can put the byte limits in one place:

schema_version = 1
[scan]
deep = false
max_decode_bytes = 1048576
max_total_decoded_bytes = 8388608
max_recursion_depth = 8
[scan.optional-features]
dynamic_analysis = "disabled"

For scan, explicitly supplied depth, strictness, recovery, parser-diff and maximum-object flags are reapplied after configuration. Other settings can be applied by the config; do not assume every CLI flag overrides every durable field. Avoid specifying one budget differently in both places. Record the resolved posture/options digest and limits from the output, not just the requested command line. Command/environment knobs can differ across surfaces and builds.

Runtime policy and reproducibility

A configured policy can be embedded or use an externally supplied bundle. external_prefer may fall back to embedded policy; external_strict fails if the supplied bundle cannot be loaded. Retain the report’s policy provenance and load status alongside input identity, configuration and build identity. Do not confuse deployment/policy profiles with the --analysis-profile breadth preset or an extraction --profile.

Live query/report/explain invocations can select different conditions from the original scan. explain finding and explain claim accept a config; other explanation surfaces have specific posture rules. sis report has no explicit --config flag. Prefer query --from-report for projections of a saved run, and read the explanation posture before treating a reanalysis as equivalent.

sis completion bash > sis-completion.bash

Completion reflects commands compiled into this binary. Choose your shell from sis completion --help and install the script using that shell’s normal procedure.

  • sis docs scan — output and automation
  • sis docs query — report-backed projections
  • sis docs explain — resolved explanation posture
  • sis docs verdict — coverage and evidence