Function buildAmassArgs

worker/src/components/security/amass.ts:367–454

(options: BuildAmassArgsOptions)

 * This follows the Dynamic Args Pattern recommended in component-development.md
 */
const buildAmassArgs = (options: BuildAmassArgsOptions): string[] => {
  const args: string[] = ['enum'];

  // CRITICAL: Always use -silent to prevent progress bar spam
  // Without this, Amass outputs "0 / 1 [____]" to stderr hundreds of times per second
  // This floods Loki and can cause system overload (see incident report)
  args.push('-silent');

  // Domain file input
  args.push('-df', options.domainFile);

  // Passive mode - recommended for quick scans
  if (options.passive) {
    args.push('-passive');
  }

  // Active techniques (zone transfers, cert grabs)
  if (options.active) {
    args.push('-active');
  }

  // Brute force
  if (options.bruteForce) {
    args.push('-brute');
  }

  // Alterations engine
  if (options.enableAlterations) {
    args.push('-alts');
  }

  // Include IP addresses
  if (options.includeIps) {
    args.push('-ip');
  }

  // Recursive brute forcing
  if (!options.recursive) {
    args.push('-norecursive');
  } else if (typeof options.minForRecursive === 'number' && options.minForRecursive >= 1) {
    args.push('-min-for-recursive', String(options.minForRecursive));
  }

  // Max depth
  if (typeof options.maxDepth === 'number' && options.maxDepth >= 1) {
    args.push('-max-depth', String(options.maxDepth));
  }

  // DNS query rate
  if (typeof options.dnsQueryRate === 'number' && options.dnsQueryRate >= 1) {
    args.push('-dns-qps', String(options.dnsQueryRate));
  }

  // Timeout
  if (typeof options.timeoutMinutes === 'number' && options.timeoutMinutes >= 1) {
    args.push('-timeout', String(options.timeoutMinutes));
  }