Description
The documentation advertises SARIF (and Markdown) as output formats, but the darnit audit CLI only offers text and json. SARIF/Markdown are reachable only through the library or MCP tool, so a CLI user following the docs cannot produce SARIF output at all.
Steps to Reproduce
- Install darnit from source (
uv sync).
- Run
darnit audit --help and note the -o/--output choices.
- Run
darnit audit -o sarif <path>.
Expected Behavior
Either sarif and markdown are accepted by -o (as the docs imply), or the docs state clearly that SARIF/Markdown are library/MCP-only.
Actual Behavior
-o accepts only text/json; -o sarif is rejected. Meanwhile the docs advertise SARIF:
docs/USAGE_GUIDE.md:14 — "Multiple output formats - Markdown, JSON, SARIF"
docs/USAGE_GUIDE.md:121 — "sarif - GitHub Code Scanning compatible"
docs/USAGE_GUIDE.md:308 — "Use SARIF output for GitHub Code Scanning"
Root cause:
packages/darnit/src/darnit/cli.py:908-911 hardcodes -o/--output choices=["text", "json"].
cli.py:236-241 dispatches only json-vs-text.
- The formatters already exist but only on the library/MCP path:
packages/darnit/src/darnit/tools/audit.py:209 (output_format = "markdown"|"json"|"sarif") and packages/darnit/src/darnit/server/tools/builtin_audit.py:37.
Environment
- darnit version:
main @ 86f9cfa
- Python version: 3.12 (uv-managed)
- OS: macOS (platform-independent)
Additional Context
Non-prescriptive suggestion: surface the already-advertised formats through the existing -o mechanism (extend choices + dispatch, reusing the existing formatters), optionally adding --output-file — i.e. match the existing output contract rather than introduce a new structure. Alternatively, correct the docs. Related: no documented recipe currently exists for producing a report file from a terminal run; that resolves naturally if the CLI can emit these formats.
Description
The documentation advertises SARIF (and Markdown) as output formats, but the
darnit auditCLI only offerstextandjson. SARIF/Markdown are reachable only through the library or MCP tool, so a CLI user following the docs cannot produce SARIF output at all.Steps to Reproduce
uv sync).darnit audit --helpand note the-o/--outputchoices.darnit audit -o sarif <path>.Expected Behavior
Either
sarifandmarkdownare accepted by-o(as the docs imply), or the docs state clearly that SARIF/Markdown are library/MCP-only.Actual Behavior
-oaccepts onlytext/json;-o sarifis rejected. Meanwhile the docs advertise SARIF:docs/USAGE_GUIDE.md:14— "Multiple output formats - Markdown, JSON, SARIF"docs/USAGE_GUIDE.md:121— "sarif - GitHub Code Scanning compatible"docs/USAGE_GUIDE.md:308— "Use SARIF output for GitHub Code Scanning"Root cause:
packages/darnit/src/darnit/cli.py:908-911hardcodes-o/--outputchoices=["text", "json"].cli.py:236-241dispatches only json-vs-text.packages/darnit/src/darnit/tools/audit.py:209(output_format = "markdown"|"json"|"sarif") andpackages/darnit/src/darnit/server/tools/builtin_audit.py:37.Environment
main@86f9cfaAdditional Context
Non-prescriptive suggestion: surface the already-advertised formats through the existing
-omechanism (extendchoices+ dispatch, reusing the existing formatters), optionally adding--output-file— i.e. match the existing output contract rather than introduce a new structure. Alternatively, correct the docs. Related: no documented recipe currently exists for producing a report file from a terminal run; that resolves naturally if the CLI can emit these formats.