class

Analyzer::Kotlin::Cli

Inherits CliEndpointSupport < Analyzer < FileHelper < Reference < Object

Surfaces the command-line attack surface of Kotlin programs as cli:// endpoints: one endpoint per (sub)command with named options (param_type "flag"), positional arguments ("argument") and consumed environment variables ("env"). Covers clikt, kotlinx-cli and picocli plus gated System.getenv reads.

Line-scan analyzer (Go/Ruby/Rust CLI house style) merging endpoints by URL. Subclasses Analyzer directly (KotlinEngine is a module) and uses KotlinEngine.test_path? to skip tests.

Constants

ARGPARSER = /\bArgParser\s*\(\s*"([^"]+)"/

kotlinx-cli.

CLIKT_ARG = /\bval\s+(\w+)\s+by\s+argument\s*\(/
CLIKT_CLASS = /\bclass\s+(\w+)\s*(?:\([^)]*\))?\s*:\s*[^{]*\bCliktCommand\b/

clikt: class Serve : CliktCommand(name = "serve") (name optional → class name lower-cased).

CLIKT_ENVVAR = /\benvvar\s*=\s*"([^"]+)"/
CLIKT_NAME = /CliktCommand\s*\([^)]*\bname\s*=\s*"([^"]+)"/
CLIKT_OPTION = /\bval\s+(\w+)\s+by\s+option\s*\(([^)]*)\)/
GET_ENV = /\bSystem\.getenv\s*\(\s*"([^"]+)"\s*\)/
KX_ARGUMENT = /\bby\s+\w*\.?argument\s*\(\s*ArgType\.\w+\s*,\s*"([^"]+)"/
KX_OPTION = /\bby\s+\w*\.?option\s*\(\s*ArgType\.\w+\s*,\s*"([^"]+)"/
LIBRARY_SIGNAL_RE = Regex.union(["com.github.ajalt.clikt", "kotlinx.cli", "picocli.CommandLine", /:\s*CliktCommand\b/, /\bArgParser\s*\(/] of Regex | String)

One precompiled Regex.union scan (PCRE2 JIT, auto-escapes each string literal) replaces the three library-marker String#includes? scans OR-ed with the CliktCommand/ArgParser regex fallback below — this gate runs once per Kotlin file in the scan.

PICOCLI_CLASS = /\bclass\s+(\w+)\b/
PICOCLI_COMMAND_START = /@Command\s*\(/

picocli: annotations sit on the line above the class/property they decorate (@Command(name = "serve") \n class Serve : Callable<Int>), so a one-line lookahead resolves each pending annotation. A @Command( may wrap across lines once description/subcommands are added, so the annotation start is matched with a bounded body-join instead of requiring the close paren on the same line.

PICOCLI_NAME = /\bname\s*=\s*"([^"]+)"/
PICOCLI_OPTION = /@Option\s*\(([^)]*)\)/
PICOCLI_PARAMS = /@Parameters\b/
PICOCLI_PROPERTY = /\b(?:var|val)\s+(\w+)\s*:/
WEB_FRAMEWORK_RE = /\bimport\s+(?:org\.springframework|io\.ktor|org\.http4k)/

Class methods

tech_name
Source

Instance methods

analyze
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source