SIS CLI

Extract Guide

sis extract recovers the textual content of a document — the body/metadata text a human, a renderer, a retriever, or a model would actually see — format-agnostically and without scoring or a verdict. It is a provenance-aware, hostile-aware text extractor (a safer pdftotext/Tika), not an analysis command: it never decides whether content is malicious. Use sis scan/sis assess for that.

When to use it

  • Feed a document’s text into a RAG pipeline, a model, or a search index — but only the safe channels.
  • See which text is visible vs. hidden/retrieval-only (the channels an injection hides in).
  • Strip the dangerous spans before ingestion (--safe), with a logged, deterministic removal contract.

Channels

Extraction is organised into typed channels. The default emits body,metadata; other classes are counted but not emitted unless you ask for them:

  • body — visible document text
  • metadata — title/author/XMP and other document metadata
  • annotation — annotation/comment text
  • embedded — text from embedded objects
  • hidden — render-suppressed / retrieval-only text (the prime prompt-injection carrier). Counted by default, not emitted — select it explicitly (--channels hidden or --include-hidden) to see it.
  • code — script/macro text
  • all — every class

Hidden channels are kept separate, never merged into body — so “the text a model sees” stays distinct from “the text an attacker concealed.”

Common invocations

sis extract report.pdf                          # markdown (YAML frontmatter), body+metadata
sis extract report.pdf --format json            # structured JSON (no frontmatter)
sis extract report.pdf --format text            # plain text only
sis extract report.pdf --channels all --include-hidden   # everything, hidden labelled
sis extract report.pdf --metadata-only          # metadata channels only

Safe text (AI-ingestion)

--safe strips the spans flagged by the safe-text removal contracts (the dangerous/hidden-instruction text), so the output is what is safe to index or feed a model:

sis scan doc.pdf --json > report.json
sis extract doc.pdf --safe --from-report report.json     # deterministic: contracts from the report
sis extract doc.pdf --safe                                # minimal inline analysis derives contracts
  • --from-report <REPORT> makes the removal deterministic (same bytes + options ⇒ identical output) by reading the contracts a prior sis scan --json produced. Prefer this for reproducible pipelines.
  • Without --from-report, --safe runs a minimal inline analysis to derive the contracts (the verdict is discarded). It fails closed if no contract source is available — it never emits unsafe text by default.
  • --safe-min-confidence <tentative|probable|strong|certain> (default probable) sets how aggressive the removal is.

Containers and batch

  • --members <inline|root-only|separate> projects container members (email attachments, archive entries, OOXML parts). inline (default) folds member channels into one document; separate emits one document per member (bounded by --max-depth, default 4); root-only suppresses members.
  • --path <DIR> [--glob PATTERN] [--jobs N] batch-extracts every matching file, streaming JSONL (--format jsonl). Format is detected from content, not extension.

Determinism

Extraction is deterministic: the same bytes + the same options (+ the pinned --posture id, for --safe inline analysis) produce byte-identical output. That makes sis extract safe to put in a reproducible ingestion pipeline and to diff across runs/versions.

Scoping to specific assets (--asset)

--asset <selector> scopes extraction to the assets matching an asset-path selector, extracting each matched member as its own document instead of the whole root. It reuses the same selector engine as sis query and the same channel/--safe/--format pipeline, applied per selected asset.

sis extract bundle.zip --asset "**/[format=ooxml]" --format json   # just the OOXML members' text
sis extract report.pdf --asset "pdf:root"                          # the root document only

Single-file only (conflicts with --path batch and --members separate — the selector is the member scoping). A no-match selector exits non-zero. Deeply-nested members beyond the flat member seam report status: unavailable. The selector grammar is in sis docs asset-graph.

What it does NOT do

  • No verdict, no findings, no scoring — use sis scan / sis assess.
  • No file rewrite — it emits text, not a sanitised document. To produce a cleaned file, use sis sanitize (CDR). sis docs cdr.
  • sis docs assess — the AI-ingestion decision that wraps safe-text
  • sis docs cdr — produce a cleaned file (not just text)
  • sis docs asset-graph — the --asset selector grammar (and /text in sis query)
  • sis docs formats — which roots are supported
  • sis docs scan-config — analysis options (extract is analysis-free, but scan feeds --from-report)