CLI Reference
Complete reference for all squirex commands and flags.
Scan Commands
| Command | Description |
|---|---|
squirex scan -d <dir> | Full workspace scan — all security rules, SARIF to stdout |
squirex scan -d <dir> --sarif <file> | Save SARIF output to a file |
squirex scan -d <dir> --rules <ids> | Run specific rules (comma-separated IDs) |
squirex scan-pr -d <dir> --base <branch> | PR-scoped scan — violations filtered to diff lines only |
squirex scan flags
| Flag | Type | Description |
|---|---|---|
-d, --directory | string | Workspace root directory (default: .) |
--sarif | string | Write SARIF output to this file path (default: stdout) |
-o, --output | string | Alias for --sarif |
--rules | string | Comma-separated rule IDs (e.g. AGENTFORCE-1.1,AGENTFORCE-SC-01); default: all |
--go-binary | string | Path to the squireinterp engine binary (or set SQUIREX_GO_BINARY) |
--strict | bool | Exit with code 3 if any discovered file could not be parsed (and so was not analysed) |
squirex scan-pr flags
scan-pr takes the same flags as scan, plus:
| Flag | Type | Description |
|---|---|---|
-b, --base | string | Required. Base branch to diff against (e.g. main, origin/develop) |
Exit codes (scan, scan-pr)
| Code | Meaning |
|---|---|
0 | Scan completed, no findings |
1 | The scan could not run (engine missing, bad arguments, or no valid license key in CI) |
2 | Scan completed and found violations |
3 | --strict only: one or more files could not be parsed |
Files that fail to parse are also listed in the SARIF run as toolExecutionNotifications (descriptor SQUIREX-PARSE). See SARIF Output.
Diagnostic Commands
| Command | Description |
|---|---|
squirex diagnose -d <dir> | Deep pipeline diagnostics — graph topology, per-rule timing, linker trace |
squirex diagnose -d <dir> --dump-request | Also write scan-request.json for golden file generation |
squirex diagnose -d <dir> | jq .graph | Inspect semantic graph node/edge counts |
squirex diagnose -d <dir> | jq .rules | Per-rule timing and violation counts |
squirex diagnose -d <dir> | jq .linker | Dropped/dangling edge report |
Testing Center Bridge
| Command | Description |
|---|---|
squirex generate-tests -d <dir> | Scan + generate Agentforce DX test YAML |
squirex generate-tests --sarif <file> | Convert existing SARIF to DX tests |
squirex generate-tests --rules <ids> | Generate tests for specific rules only |
squirex generate-tests --validate | Generate + validate spec via sf agent test run |
squirex generate-tests --push --target-org <org> | Generate + push to Testing Center |
squirex generate-tests --json | Output as JSON instead of YAML |
Apex Runtime Commands
| Command | Description |
|---|---|
squirex init | Generate .squirex.json config in current directory |
squirex doctor | Check environment — Node.js, Go interpreter, project config |
squirex run -d <dir> | Run all Apex tests in directory |
squirex run --method <class.method> | Run a single test method |
squirex run --coverage | Print coverage summary table |
squirex run --junit <file> | Write JUnit XML report |
squirex run --parallel | Enable parallel test execution |
squirex run --mock-data <file> | Seed SObject records from JSON before test run |
squirex run --coverage-report <file> | Write LCOV or JSON coverage report |
Analysis Commands
| Command | Description |
|---|---|
squirex conflict -b <b1,b2> | Predict merge conflicts between two branches |
squirex impact -f <files> | Dependency impact — which tests are affected by a file change |
squirex schema analyze | Schema inference analysis — inferred SObject/field types |
squirex formula eval -e <expr> | Evaluate a Salesforce formula expression locally |
squirex flow run -f <file> | Execute a Flow definition locally |
squirex graph-export -d <dir> --format dot|mermaid|html | Export the semantic graph (Graphviz DOT, Mermaid, or interactive HTML) |
The rule registry export lives on the Go engine binary, not the squirex CLI:
squireinterp graph-export --rules --format json # id, name, category, severity, description, compliance
It needs no input directory, and it is the canonical source behind the rule catalog and the generated Security Rules reference. squirex doctor -v prints where the engine binary is.
Global Flags
| Flag | Description |
|---|---|
--no-color | Disable colorized output |
-V, --version | Print version and build metadata |
-h, --help | Show help for any command |
Environment Variables
| Variable | Description |
|---|---|
SQUIREX_LICENSE_KEY | Pro or Enterprise license key. Required to run scan/scan-pr in CI (detected via CI, GITHUB_ACTIONS, …); local runs need no key. Can also be set as licenseKey in .squirex.json. |
SQUIREX_REPO_SCOPE | owner/repo sent with the key so a Pro key is checked against the repository it was bought for. Defaults to GITHUB_REPOSITORY on GitHub Actions. |
SQUIREX_GO_BINARY | Path to the squireinterp engine binary (same as --go-binary) |
NO_COLOR | Standard UNIX no-color convention — disables color output |
SQUIREX_VERIFIED=1 no longer unlocks CI runs: it is ignored when set by users. Only the hosted GitHub App and hosted scanner skip the license check, through an internal server-side handshake.