chore: import upstream snapshot with attribution

test/codeScans/scanner/fork-pr-auth.test.ts

@@ -0,0 +1,190 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+describe('Scanner fork PR auth rejection', () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    process.exitCode = 0;
+  });
+
+  function mockForkPrAuthScanner() {
+    vi.doMock('../../../src/codeScan/git/diffProcessor', () => ({
+      processDiff: vi.fn().mockResolvedValue([
+        {
+          path: 'src/index.ts',
+          status: 'M',
+          shaA: 'abc123',
+          shaB: 'def456',
+          linesAdded: 5,
+          linesRemoved: 2,
+          patch: '@@ -1,3 +1,4 @@\n+const test = true;\n const existing = true;',
+        },
+      ]),
+    }));
+    vi.doMock('../../../src/codeScan/git/diff', () => ({
+      validateOnBranch: vi.fn().mockResolvedValue('main'),
+    }));
+    vi.doMock('../../../src/codeScan/git/metadata', () => ({
+      extractMetadata: vi.fn().mockResolvedValue({
+        branch: 'main',
+        baseBranch: 'main',
+        baseRef: 'main',
+        baseSha: 'base123',
+        compareRef: 'HEAD',
+        compareSha: 'compare123',
+        commitMessages: ['test commit'],
+        author: 'Minh Vu',
+        timestamp: '2026-05-23T00:00:00.000Z',
+      }),
+    }));
+    vi.doMock('../../../src/codeScan/config/loader', () => ({
+      loadConfigOrDefault: vi.fn().mockReturnValue({
+        minimumSeverity: 'medium',
+        diffsOnly: true,
+      }),
+      mergeConfigWithOptions: vi.fn().mockImplementation((config, options) => ({
+        ...config,
+        diffsOnly: options.diffsOnly ?? config.diffsOnly,
+      })),
+      resolveGuidance: vi.fn().mockReturnValue(undefined),
+      resolveApiHost: vi.fn().mockReturnValue('https://api.example.com'),
+    }));
+    vi.doMock('simple-git', () => ({
+      default: vi.fn(() => ({
+        branch: vi.fn().mockResolvedValue({ current: 'main', all: ['main'] }),
+        revparse: vi.fn().mockResolvedValue('abc123'),
+      })),
+    }));
+    vi.doMock('../../../src/util/agent/agentClient', () => ({
+      createAgentClient: vi.fn().mockResolvedValue({
+        sessionId: 'test-session-id',
+        disconnect: vi.fn(),
+        socket: { io: { off: vi.fn() } },
+      }),
+    }));
+    vi.doMock('../../../src/codeScan/util/auth', () => ({
+      resolveAuthCredentials: vi.fn().mockReturnValue({ apiKey: 'test-key' }),
+    }));
+    vi.doMock('../../../src/cliState', () => ({
+      default: { postActionCallback: null },
+    }));
+    vi.doMock('../../../src/logger', () => ({
+      default: { info: vi.fn(), debug: vi.fn(), error: vi.fn(), warn: vi.fn() },
+      getLogLevel: vi.fn().mockReturnValue('info'),
+      setLogLevel: vi.fn(),
+    }));
+    vi.doMock('../../../src/codeScan/scanner/cleanup', () => ({
+      registerCleanupHandlers: vi.fn(),
+    }));
+    vi.doMock('../../../src/codeScan/scanner/output', () => ({
+      createSpinner: vi.fn().mockReturnValue(undefined),
+      displayScanResults: vi.fn(),
+    }));
+    vi.doMock('../../../src/codeScan/scanner/request', () => ({
+      buildScanRequest: vi.fn().mockReturnValue({ request: 'test' }),
+      executeScanRequestWithRetry: vi
+        .fn()
+        .mockRejectedValue(new Error('Fork PR scanning not authorized')),
+    }));
+  }
+
+  const SKIP_MESSAGE = 'Fork PR scanning requires maintainer approval. See PR comment for options.';
+
+  it('emits a structured skip response with skipReason in json mode', async () => {
+    mockForkPrAuthScanner();
+
+    const { executeScan } = await import('../../../src/codeScan/scanner/index');
+    const { displayScanResults } = await import('../../../src/codeScan/scanner/output');
+    const { setLogLevel } = await import('../../../src/logger');
+    const cliState = (await import('../../../src/cliState')).default;
+    const { executeScanRequestWithRetry } = await import('../../../src/codeScan/scanner/request');
+    const { processDiff } = await import('../../../src/codeScan/git/diffProcessor');
+
+    await executeScan('/test/repo', {
+      format: 'json',
+      diffsOnly: true,
+      githubPr: 'test-owner/test-repo#123',
+    });
+
+    expect(processDiff).toHaveBeenCalled();
+    expect(executeScanRequestWithRetry).toHaveBeenCalled();
+
+    expect(displayScanResults).toHaveBeenCalledWith(
+      {
+        success: true,
+        comments: [],
+        skipReason: SKIP_MESSAGE,
+      },
+      expect.any(Number),
+      {
+        format: 'json',
+        githubPr: 'test-owner/test-repo#123',
+      },
+    );
+    expect(setLogLevel).toHaveBeenCalledWith('error');
+    expect(typeof cliState.postActionCallback).toBe('function');
+
+    await cliState.postActionCallback?.();
+
+    expect(process.exitCode).toBe(0);
+  });
+
+  it('does not emit empty SARIF when fork authorization skips the scan', async () => {
+    mockForkPrAuthScanner();
+    vi.doUnmock('../../../src/codeScan/scanner/output');
+
+    const stdoutSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const stderrSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    const { executeScan } = await import('../../../src/codeScan/scanner/index');
+    const cliState = (await import('../../../src/cliState')).default;
+    const logger = (await import('../../../src/logger')).default;
+
+    await executeScan('/test/repo', {
+      format: 'sarif',
+      diffsOnly: true,
+      githubPr: 'test-owner/test-repo#123',
+    });
+
+    await cliState.postActionCallback?.();
+
+    expect(stdoutSpy).not.toHaveBeenCalled();
+    expect(stderrSpy).toHaveBeenCalledWith(
+      `Scan skipped: ${SKIP_MESSAGE} SARIF output was not generated because the scan did not complete.`,
+    );
+    expect(logger.error).not.toHaveBeenCalled();
+    expect(process.exitCode).toBe(1);
+  });
+
+  it('emits stdout JSON that the action can round-trip parse', async () => {
+    mockForkPrAuthScanner();
+    // Use the real output module so we exercise the actual stdout serialization.
+    vi.doUnmock('../../../src/codeScan/scanner/output');
+
+    const stdoutSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+
+    const { executeScan } = await import('../../../src/codeScan/scanner/index');
+    const cliState = (await import('../../../src/cliState')).default;
+
+    await executeScan('/test/repo', {
+      json: true,
+      diffsOnly: true,
+      githubPr: 'test-owner/test-repo#123',
+    });
+
+    const stdout = stdoutSpy.mock.calls.map((args) => args.join('')).join('');
+    const parsed = JSON.parse(stdout);
+    expect(parsed).toMatchObject({
+      success: true,
+      comments: [],
+      skipReason: SKIP_MESSAGE,
+    });
+    expect(parsed).not.toHaveProperty('commentsPosted');
+
+    await cliState.postActionCallback?.();
+    expect(process.exitCode).toBe(0);
+  });
+});

test/codeScans/scanner/request.test.ts

@@ -0,0 +1,216 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { executeScanRequestWithRetry } from '../../../src/codeScan/scanner/request';
+import { sleepWithAbort } from '../../../src/util/time';
+
+import type { ScanRequest, ScanResponse } from '../../../src/types/codeScan';
+import type { AgentClient } from '../../../src/util/agent/agentClient';
+
+vi.mock('../../../src/util/time', () => ({
+  sleepWithAbort: vi.fn().mockResolvedValue(undefined),
+}));
+
+type ScanOutcome =
+  | { type: 'complete'; response: ScanResponse }
+  | { type: 'error'; message: string };
+
+function createMockAgentClient(outcomes: ScanOutcome[]) {
+  let completeHandler: ((response: ScanResponse) => void) | undefined;
+  let errorHandler: ((error: { type: string; message: string }) => void) | undefined;
+  let cancelledHandler: (() => void) | undefined;
+
+  const client = {
+    sessionId: 'test-session',
+    start: vi.fn(() => {
+      const outcome = outcomes.shift();
+
+      queueMicrotask(() => {
+        if (!outcome) {
+          errorHandler?.({ type: 'test_error', message: 'No test outcome configured' });
+          return;
+        }
+
+        if (outcome.type === 'complete') {
+          completeHandler?.(outcome.response);
+        } else {
+          errorHandler?.({ type: 'agent_error', message: outcome.message });
+        }
+      });
+    }),
+    cancel: vi.fn(),
+    onComplete: vi.fn((handler: (response: ScanResponse) => void) => {
+      completeHandler = handler;
+    }),
+    onError: vi.fn((handler: (error: { type: string; message: string }) => void) => {
+      errorHandler = handler;
+    }),
+    onCancelled: vi.fn((handler: () => void) => {
+      cancelledHandler = handler;
+    }),
+    on: vi.fn(),
+    emit: vi.fn(),
+    disconnect: vi.fn(),
+    socket: {
+      io: {
+        once: vi.fn(),
+        off: vi.fn(),
+      },
+    },
+  } as unknown as AgentClient;
+
+  return {
+    client,
+    cancelledHandler: () => cancelledHandler,
+  };
+}
+
+const scanRequest = {
+  sessionId: 'test-session',
+} as ScanRequest;
+
+const scanResponse: ScanResponse = {
+  success: true,
+  comments: [],
+  review: 'all clear',
+};
+
+function createExecutionOptions() {
+  return {
+    showSpinner: false,
+    abortController: new AbortController(),
+  };
+}
+
+describe('executeScanRequestWithRetry', () => {
+  beforeEach(() => {
+    vi.mocked(sleepWithAbort).mockReset();
+    vi.mocked(sleepWithAbort).mockResolvedValue(undefined);
+  });
+
+  afterEach(() => {
+    vi.mocked(sleepWithAbort).mockReset();
+  });
+
+  it('retries once when the remote scanner times out waiting for MCP repository access', async () => {
+    const { client } = createMockAgentClient([
+      { type: 'error', message: 'Internal server error: MCP error -32001: Request timed out' },
+      { type: 'complete', response: scanResponse },
+    ]);
+
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).resolves.toEqual(scanResponse);
+
+    expect(client.start).toHaveBeenCalledTimes(2);
+    expect(sleepWithAbort).toHaveBeenCalledTimes(1);
+  });
+
+  it('stops after one retry for repeated MCP repository access timeouts', async () => {
+    const { client } = createMockAgentClient([
+      { type: 'error', message: 'Internal server error: MCP error -32001: Request timed out' },
+      { type: 'error', message: 'Internal server error: MCP error -32001: Request timed out' },
+      { type: 'complete', response: scanResponse },
+    ]);
+
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).rejects.toThrow('Internal server error: MCP error -32001: Request timed out');
+
+    expect(client.start).toHaveBeenCalledTimes(2);
+    expect(sleepWithAbort).toHaveBeenCalledTimes(1);
+  });
+
+  it('continues to use the longer retry budget for server capacity errors', async () => {
+    const { client } = createMockAgentClient([
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'complete', response: scanResponse },
+    ]);
+
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).resolves.toEqual(scanResponse);
+
+    expect(client.start).toHaveBeenCalledTimes(3);
+    expect(sleepWithAbort).toHaveBeenCalledTimes(2);
+  });
+
+  it('succeeds on first attempt without retrying', async () => {
+    const { client } = createMockAgentClient([{ type: 'complete', response: scanResponse }]);
+
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).resolves.toEqual(scanResponse);
+
+    expect(client.start).toHaveBeenCalledTimes(1);
+    expect(sleepWithAbort).not.toHaveBeenCalled();
+  });
+
+  it('enforces MCP timeout budget independently when preceded by capacity errors', async () => {
+    const { client } = createMockAgentClient([
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Internal server error: MCP error -32001: Request timed out' },
+      { type: 'error', message: 'Internal server error: MCP error -32001: Request timed out' },
+      { type: 'complete', response: scanResponse },
+    ]);
+
+    // Two capacity retries succeed, then the MCP timeout budget (2) is exhausted
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).rejects.toThrow('Internal server error: MCP error -32001: Request timed out');
+
+    // 2 capacity + 2 MCP timeout = 4 total starts
+    expect(client.start).toHaveBeenCalledTimes(4);
+    expect(sleepWithAbort).toHaveBeenCalledTimes(3);
+  });
+
+  it('enforces capacity budget independently when preceded by MCP timeout', async () => {
+    const { client } = createMockAgentClient([
+      { type: 'error', message: 'Internal server error: MCP error -32001: Request timed out' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'complete', response: scanResponse },
+    ]);
+
+    // MCP timeout uses 1 of its 2 attempts, then capacity error uses 1 of its 7 → succeeds
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).resolves.toEqual(scanResponse);
+
+    expect(client.start).toHaveBeenCalledTimes(3);
+    expect(sleepWithAbort).toHaveBeenCalledTimes(2);
+  });
+
+  it('can succeed after mixed transient failures exceed one policy total', async () => {
+    const { client } = createMockAgentClient([
+      { type: 'error', message: 'Internal server error: MCP error -32001: Request timed out' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'error', message: 'Server at capacity. Please retry.' },
+      { type: 'complete', response: scanResponse },
+    ]);
+
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).resolves.toEqual(scanResponse);
+
+    expect(client.start).toHaveBeenCalledTimes(8);
+    expect(sleepWithAbort).toHaveBeenCalledTimes(7);
+  });
+
+  it('does not retry non-transient scanner errors', async () => {
+    const { client } = createMockAgentClient([
+      { type: 'error', message: 'Invalid scan request' },
+      { type: 'complete', response: scanResponse },
+    ]);
+
+    await expect(
+      executeScanRequestWithRetry(client, scanRequest, createExecutionOptions()),
+    ).rejects.toThrow('Invalid scan request');
+
+    expect(client.start).toHaveBeenCalledTimes(1);
+    expect(sleepWithAbort).not.toHaveBeenCalled();
+  });
+});

test/codeScans/scanner/resolveOutputFormat.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest';
+import { resolveOutputFormat } from '../../../src/codeScan/scanner/index';
+import { CodeScanOutputFormat } from '../../../src/types/codeScan';
+
+describe('resolveOutputFormat', () => {
+  it('defaults to TEXT when neither --json nor --format is given', () => {
+    expect(resolveOutputFormat({})).toBe(CodeScanOutputFormat.TEXT);
+  });
+
+  it('returns the requested --format value', () => {
+    expect(resolveOutputFormat({ format: 'text' })).toBe(CodeScanOutputFormat.TEXT);
+    expect(resolveOutputFormat({ format: 'json' })).toBe(CodeScanOutputFormat.JSON);
+    expect(resolveOutputFormat({ format: 'sarif' })).toBe(CodeScanOutputFormat.SARIF);
+  });
+
+  it('promotes --json to JSON regardless of the default --format', () => {
+    expect(resolveOutputFormat({ json: true })).toBe(CodeScanOutputFormat.JSON);
+  });
+
+  it('lets --json win over --format text (back-compat with the old --json-only flag)', () => {
+    expect(resolveOutputFormat({ json: true, format: 'text' })).toBe(CodeScanOutputFormat.JSON);
+  });
+
+  it('treats --json + --format json as JSON without complaint', () => {
+    expect(resolveOutputFormat({ json: true, format: 'json' })).toBe(CodeScanOutputFormat.JSON);
+  });
+
+  it('rejects --json + --format sarif as ambiguous', () => {
+    expect(() => resolveOutputFormat({ json: true, format: 'sarif' })).toThrow(
+      /Cannot combine --json with --format sarif/,
+    );
+  });
+
+  it('rejects unknown --format values with a discoverable message', () => {
+    expect(() => resolveOutputFormat({ format: 'xml' })).toThrow(
+      /Invalid output format "xml".*text, json, sarif/,
+    );
+  });
+});