vulkro bench

Walk a fixtures directory and assert that every positive_<name>.<ext> fires the matching detector and every negative_<name>.<ext> stays silent. This catches detector regressions without per-rule integration tests. Useful when you maintain your own rule packs or fixtures.

Usage

vulkro bench --fixtures ./bench/fixtures

Flags

Flag	Description	Default
--fixtures <PATH>	Root directory of <rule>/positive_*.<ext> and <rule>/negative_*.<ext> fixtures.	bench/fixtures

Exit codes

• 0 every fixture matches expectation.
• 1 at least one fixture violates the positive / negative contract.
• 2 IO failure (fixtures directory missing, and similar).

Related

• vulkro rules - author and manage rule packs.
• Suppressions - suppressing findings in source and config.

Command reference

Generated from vulkro help bench on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Run the detector fixtures to check that every rule still fires as expected.

Walk a fixtures directory and assert every POSITIVE sample fires the matching detector, every NEGATIVE sample stays silent. A sample declares its polarity in its own name, in any of four recognised shapes: `positive_x.ext`, a bare `positive/` directory or `positive.ext`, `pos_X.ext`, or the suffix form `x_positive.ext` (and the `negative` / `neg_` equivalents). Catches detector regressions without per-rule integration tests. The default fixtures root is `bench/fixtures/`.

Exit codes: 0  every fixture matches expectation. 1  at least one fixture violates the positive/negative contract. 2  IO failure (fixtures dir missing, etc.).

Usage: vulkro bench [OPTIONS]

Options:
      --fixtures <PATH>
          Root directory holding `<rule>/<sample>` fixtures, where each sample name declares its polarity in one of the four recognised shapes
          
          [default: bench/fixtures]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -h, --help
          Print help (see a summary with '-h')