ghagga 2.8.1 → 3.1.0

package/dist/commands/review.postback-disclosure.test.js

@@ -0,0 +1,192 @@
+/**
+ * SECURITY HYGIENE — before the CLI posts a review back to a forge (`--pr` GitHub
+ * PR / `--mr` GitLab MR), it discloses the DESTINATION HOST on stderr so the user
+ * sees where their token is going BEFORE the network POST fires.
+ *
+ * Rationale: the GitLab API base is derived from the git remote host, so a
+ * poisoned `origin` could exfiltrate GITLAB_TOKEN. Disclosing the REAL resolved
+ * host makes that visible.
+ *
+ * These tests assert:
+ *   - the disclosure line is emitted to STDERR (console.error), NOT stdout
+ *     (stdout is reserved for SARIF / JSON / markdown output)
+ *   - the host is correct for --pr (api.github.com) and --mr (gitlab.com)
+ *   - a self-hosted GitLab remote discloses THAT host (real resolution, not a
+ *     mock) — this is the poisoned-origin-visible case
+ *
+ * For the GitLab path we deliberately use the REAL parseGitLabRemote +
+ * resolveGitLabApiBase (only the network seams are mocked) so the host shown is
+ * the genuinely-resolved destination.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+vi.mock('ghagga-core', () => ({
+    reviewPipeline: vi.fn(),
+    buildSarif: vi.fn().mockReturnValue({ version: '2.1.0', runs: [] }),
+    formatReviewComment: vi.fn().mockReturnValue('<!-- ghagga-review -->\nbody'),
+    formatBoxSummary: vi.fn().mockReturnValue([]),
+    REVIEW_COMMENT_MARKER: '<!-- ghagga-review -->',
+    DEFAULT_SETTINGS: {
+        enableSemgrep: true,
+        enableTrivy: true,
+        enableCpd: true,
+        enableMemory: true,
+        customRules: [],
+        ignorePatterns: [],
+        reviewLevel: 'normal',
+        enabledTools: [],
+        disabledTools: [],
+    },
+    DEFAULT_MODELS: { gateway: 'auto', 'cli-bridge': 'auto', ollama: 'llama3' },
+    initializeDefaultTools: vi.fn(),
+    toolRegistry: { getAll: vi.fn().mockReturnValue([]) },
+    EngramMemoryStorage: { create: vi.fn() },
+    SqliteMemoryStorage: { create: vi.fn() },
+    formatReviewResult: vi.fn(),
+}));
+vi.mock('node:child_process', () => ({ execSync: vi.fn() }));
+vi.mock('node:fs', () => ({ readFileSync: vi.fn(), existsSync: vi.fn().mockReturnValue(false) }));
+// Token + post-back seams (network) are mocked; remote-parse + api-base are REAL.
+vi.mock('../lib/pr-token.js', () => ({ resolvePrToken: vi.fn() }));
+vi.mock('../lib/gitlab-token.js', () => ({ resolveMrToken: vi.fn() }));
+vi.mock('../lib/pr-postback.js', () => ({ postSummaryComment: vi.fn() }));
+vi.mock('../lib/github-api.js', () => ({
+    parseGitHubRemote: vi.fn().mockReturnValue({ owner: 'acme', repo: 'ci' }),
+    createComment: vi.fn(),
+    createIssue: vi.fn(),
+    ensureLabel: vi.fn(),
+    formatIssueBody: vi.fn(),
+}));
+// NOTE: gitlab-api.js (parseGitLabRemote) and the resolveGitLabApiBase host
+// derivation are NOT mocked — we want the REAL resolved host disclosed.
+vi.mock('../lib/cli-gitlab-client-port.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createCliGitLabClientPort: vi.fn(),
+        resolveGitLabProjectId: vi.fn().mockResolvedValue('12345'),
+    };
+});
+vi.mock('ghagga-forge', () => ({
+    GitHubForgeAdapter: class {
+    },
+    GitLabForgeAdapter: class {
+    },
+    StaticTokenProvider: class {
+        async getToken() {
+            return 'tok';
+        }
+    },
+}));
+vi.mock('../lib/cli-github-client-port.js', () => ({ createCliGitHubClientPort: vi.fn() }));
+import { execSync } from 'node:child_process';
+import { reviewPipeline } from 'ghagga-core';
+import { resolveMrToken } from '../lib/gitlab-token.js';
+import { postSummaryComment } from '../lib/pr-postback.js';
+import { resolvePrToken } from '../lib/pr-token.js';
+const mockExecSync = vi.mocked(execSync);
+const mockReviewPipeline = vi.mocked(reviewPipeline);
+const mockResolvePrToken = vi.mocked(resolvePrToken);
+const mockResolveMrToken = vi.mocked(resolveMrToken);
+const mockPostSummaryComment = vi.mocked(postSummaryComment);
+function defaultOptions(overrides = {}) {
+    return {
+        mode: 'simple',
+        provider: 'gateway',
+        model: 'm',
+        apiKey: 'k',
+        semgrep: true,
+        trivy: true,
+        cpd: true,
+        memory: false,
+        verbose: false,
+        disableTools: [],
+        enableTools: [],
+        ...overrides,
+    };
+}
+function passedResult() {
+    return {
+        status: 'PASSED',
+        summary: 'ok',
+        findings: [],
+        staticAnalysis: {
+            semgrep: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            trivy: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            cpd: { status: 'skipped', findings: [], executionTimeMs: 0 },
+        },
+        memoryContext: null,
+        metadata: {
+            mode: 'simple',
+            provider: 'gateway',
+            model: 'm',
+            tokensUsed: 1,
+            executionTimeMs: 1,
+            toolsRun: [],
+            toolsSkipped: [],
+            fileList: [],
+        },
+    };
+}
+describe('reviewCommand — forge post-back DESTINATION HOST disclosure (stderr)', () => {
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let errorSpy;
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let logSpy;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.spyOn(process, 'exit').mockImplementation((() => { }));
+        errorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        logSpy = vi.spyOn(console, 'log').mockImplementation(() => { });
+        mockReviewPipeline.mockResolvedValue(passedResult());
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 77, deletedNativeIds: [] });
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    /** All console.error lines as one blob for substring assertions. */
+    function stderrBlob() {
+        return errorSpy.mock.calls.map((c) => String(c[0])).join('\n');
+    }
+    function stdoutBlob() {
+        return logSpy.mock.calls.map((c) => String(c[0])).join('\n');
+    }
+    it('--pr discloses api.github.com on stderr (not stdout), before the POST', async () => {
+        mockResolvePrToken.mockReturnValue('ghp');
+        mockExecSync.mockReturnValue('git@github.com:acme/ci.git');
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 3, outputFormat: 'sarif' }));
+        expect(stderrBlob()).toContain('→ Posting PR #3 review to api.github.com');
+        // MUST NOT pollute stdout (SARIF lives there).
+        expect(stdoutBlob()).not.toContain('Posting PR');
+        expect(stdoutBlob()).not.toContain('api.github.com');
+    });
+    it('--mr discloses the gitlab.com host on stderr (not stdout)', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockExecSync.mockReturnValue('git@gitlab.com:acme/widgets.git');
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        expect(stderrBlob()).toContain('→ Posting MR #7 review to gitlab.com');
+        expect(stdoutBlob()).not.toContain('Posting MR');
+        expect(stdoutBlob()).not.toContain('gitlab.com');
+    });
+    it('--mr on a SELF-HOSTED GitLab discloses THAT host (poisoned-origin visible)', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        // The git remote points at a self-managed/poisoned host — the disclosure must
+        // surface the REAL resolved API host, not a hardcoded gitlab.com.
+        mockExecSync.mockReturnValue('git@gitlab.internal.example:team/app.git');
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 42, outputFormat: 'sarif' }));
+        expect(stderrBlob()).toContain('→ Posting MR #42 review to gitlab.internal.example');
+        expect(stdoutBlob()).not.toContain('gitlab.internal.example');
+    });
+    it('the disclosure is emitted BEFORE the post (host shown even when the post throws)', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockExecSync.mockReturnValue('git@gitlab.com:acme/widgets.git');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitLab 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        // Disclosure present even though the post failed afterwards.
+        expect(stderrBlob()).toContain('→ Posting MR #7 review to gitlab.com');
+    });
+});
+//# sourceMappingURL=review.postback-disclosure.test.js.map

package/dist/commands/review.postback-disclosure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.postback-disclosure.test.js","sourceRoot":"","sources":["../../src/commands/review.postback-disclosure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnE,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,8BAA8B,CAAC;IAC5E,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IAC7C,qBAAqB,EAAE,wBAAwB;IAC/C,gBAAgB,EAAE;QAChB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;KAClB;IACD,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3E,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE;IACrD,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC5B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAElG,kFAAkF;AAClF,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACnE,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;CACzB,CAAC,CAAC,CAAC;AACJ,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACnE,MAAM,MAAM,GAAG,MAAM,cAAc,EAAqD,CAAC;IACzF,OAAO;QACL,GAAG,MAAM;QACT,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE;QAClC,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;KAC3D,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,kBAAkB,EAAE;KAAQ;IAC5B,kBAAkB,EAAE;KAAQ;IAC5B,mBAAmB,EAAE;QACnB,KAAK,CAAC,QAAQ;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE5F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,sBAAsB,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAE7D,SAAS,cAAc,CAAC,YAAoC,EAAE;IAC5D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAC9D,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;SAC7D;QACD,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,EAAE;SACb;KACc,CAAC;AACpB,CAAC;AAED,QAAQ,CAAC,sEAAsE,EAAE,GAAG,EAAE;IACpF,kDAAkD;IAClD,IAAI,QAAa,CAAC;IAClB,kDAAkD;IAClD,IAAI,MAAW,CAAC;IAEhB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAU,CAAC,CAAC;QAClE,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnE,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/D,kBAAkB,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACrD,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,SAAS,UAAU;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,SAAS,UAAU;QACjB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,YAAY,CAAC,eAAe,CAAC,4BAAqC,CAAC,CAAC;QAEpE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAC3E,+CAA+C;QAC/C,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,YAAY,CAAC,eAAe,CAAC,iCAA0C,CAAC,CAAC;QAEzE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,8EAA8E;QAC9E,kEAAkE;QAClE,YAAY,CAAC,eAAe,CAAC,0CAAmD,CAAC,CAAC;QAElF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,oDAAoD,CAAC,CAAC;QACrF,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,YAAY,CAAC,eAAe,CAAC,iCAA0C,CAAC,CAAC;QACzE,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,6DAA6D;QAC7D,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/review.pr-exit.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * FIX 3 (P3 4vr) — `--pr` post-back failure must be BLOCKING by default.
+ *
+ * `--pr` is an explicitly-requested side-effect. In CI (Jenkins) a post-back
+ * that throws — or a missing token — must FAIL the job (non-zero exit), not
+ * silently exit 0. `--pr-soft-fail` restores the old non-blocking behavior.
+ *
+ * We mock the seams reviewCommand composes (pipeline, git, token, post-back,
+ * core formatters) so these tests are deterministic and offline, and assert the
+ * resolved process exit code.
+ */
+export {};
+//# sourceMappingURL=review.pr-exit.test.d.ts.map

package/dist/commands/review.pr-exit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.pr-exit.test.d.ts","sourceRoot":"","sources":["../../src/commands/review.pr-exit.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/commands/review.pr-exit.test.js

@@ -0,0 +1,162 @@
+/**
+ * FIX 3 (P3 4vr) — `--pr` post-back failure must be BLOCKING by default.
+ *
+ * `--pr` is an explicitly-requested side-effect. In CI (Jenkins) a post-back
+ * that throws — or a missing token — must FAIL the job (non-zero exit), not
+ * silently exit 0. `--pr-soft-fail` restores the old non-blocking behavior.
+ *
+ * We mock the seams reviewCommand composes (pipeline, git, token, post-back,
+ * core formatters) so these tests are deterministic and offline, and assert the
+ * resolved process exit code.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+// ─── Mock ghagga-core: only what review.ts touches on the --pr path ──
+vi.mock('ghagga-core', () => ({
+    reviewPipeline: vi.fn(),
+    buildSarif: vi.fn().mockReturnValue({ version: '2.1.0', runs: [] }),
+    formatReviewComment: vi.fn().mockReturnValue('<!-- ghagga-review -->\nbody'),
+    formatBoxSummary: vi.fn().mockReturnValue([]),
+    REVIEW_COMMENT_MARKER: '<!-- ghagga-review -->',
+    DEFAULT_SETTINGS: {
+        enableSemgrep: true,
+        enableTrivy: true,
+        enableCpd: true,
+        enableMemory: true,
+        customRules: [],
+        ignorePatterns: [],
+        reviewLevel: 'normal',
+        enabledTools: [],
+        disabledTools: [],
+    },
+    DEFAULT_MODELS: { gateway: 'auto', 'cli-bridge': 'auto', ollama: 'llama3' },
+    initializeDefaultTools: vi.fn(),
+    toolRegistry: { getAll: vi.fn().mockReturnValue([]) },
+    EngramMemoryStorage: { create: vi.fn() },
+    SqliteMemoryStorage: { create: vi.fn() },
+    formatReviewResult: vi.fn(),
+}));
+vi.mock('node:child_process', () => ({ execSync: vi.fn() }));
+vi.mock('node:fs', () => ({ readFileSync: vi.fn(), existsSync: vi.fn().mockReturnValue(false) }));
+// PR-token + remote-parse + post-back seams.
+vi.mock('../lib/pr-token.js', () => ({ resolvePrToken: vi.fn() }));
+vi.mock('../lib/pr-postback.js', () => ({ postSummaryComment: vi.fn() }));
+vi.mock('../lib/github-api.js', () => ({
+    parseGitHubRemote: vi.fn().mockReturnValue({ owner: 'acme', repo: 'ci' }),
+    createComment: vi.fn(),
+    createIssue: vi.fn(),
+    ensureLabel: vi.fn(),
+    formatIssueBody: vi.fn(),
+}));
+// The forge adapter + client port are constructed but never exercised (post-back
+// is mocked); stub them so construction is cheap.
+vi.mock('ghagga-forge', () => ({
+    GitHubForgeAdapter: class {
+    },
+    StaticTokenProvider: class {
+        async getToken() {
+            return 'tok';
+        }
+    },
+}));
+vi.mock('../lib/cli-github-client-port.js', () => ({ createCliGitHubClientPort: vi.fn() }));
+import { execSync } from 'node:child_process';
+import { reviewPipeline } from 'ghagga-core';
+import { postSummaryComment } from '../lib/pr-postback.js';
+import { resolvePrToken } from '../lib/pr-token.js';
+const mockExecSync = vi.mocked(execSync);
+const mockReviewPipeline = vi.mocked(reviewPipeline);
+const mockResolvePrToken = vi.mocked(resolvePrToken);
+const mockPostSummaryComment = vi.mocked(postSummaryComment);
+function defaultOptions(overrides = {}) {
+    return {
+        mode: 'simple',
+        provider: 'gateway',
+        model: 'm',
+        apiKey: 'k',
+        semgrep: true,
+        trivy: true,
+        cpd: true,
+        memory: false,
+        verbose: false,
+        disableTools: [],
+        enableTools: [],
+        ...overrides,
+    };
+}
+function passedResult() {
+    return {
+        status: 'PASSED',
+        summary: 'ok',
+        findings: [],
+        staticAnalysis: {
+            semgrep: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            trivy: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            cpd: { status: 'skipped', findings: [], executionTimeMs: 0 },
+        },
+        memoryContext: null,
+        metadata: {
+            mode: 'simple',
+            provider: 'gateway',
+            model: 'm',
+            tokensUsed: 1,
+            executionTimeMs: 1,
+            toolsRun: [],
+            toolsSkipped: [],
+            fileList: [],
+        },
+    };
+}
+describe('reviewCommand — --pr post-back exit semantics (FIX 3)', () => {
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let exitSpy;
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let errorSpy;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => { }));
+        errorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+        mockExecSync.mockReturnValue('diff content');
+        mockReviewPipeline.mockResolvedValue(passedResult());
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('--pr + post-back throws → exits NON-ZERO (1) even when review PASSED', async () => {
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitHub 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+    it('--pr + missing token → exits NON-ZERO (1) with a clear message', async () => {
+        mockResolvePrToken.mockReturnValue(undefined);
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--pr requires a GitHub token'));
+    });
+    it('--pr-soft-fail + post-back throws → WARNS and exits 0 (review PASSED)', async () => {
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitHub 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, prSoftFail: true, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(0);
+    });
+    it('--pr success → exits 0 when review PASSED', async () => {
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 7, deletedNativeIds: [] });
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(0);
+    });
+    it('does NOT mask a review-found-issues exit: --pr success + FAILED review → exit 1', async () => {
+        mockReviewPipeline.mockResolvedValue({ ...passedResult(), status: 'FAILED' });
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 7, deletedNativeIds: [] });
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+});
+//# sourceMappingURL=review.pr-exit.test.js.map

package/dist/commands/review.pr-exit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.pr-exit.test.js","sourceRoot":"","sources":["../../src/commands/review.pr-exit.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,wEAAwE;AACxE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnE,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,8BAA8B,CAAC;IAC5E,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IAC7C,qBAAqB,EAAE,wBAAwB;IAC/C,gBAAgB,EAAE;QAChB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;KAClB;IACD,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3E,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE;IACrD,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC5B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAElG,6CAA6C;AAC7C,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACnE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;CACzB,CAAC,CAAC,CAAC;AACJ,iFAAiF;AACjF,kDAAkD;AAClD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,kBAAkB,EAAE;KAAQ;IAC5B,mBAAmB,EAAE;QACnB,KAAK,CAAC,QAAQ;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE5F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,sBAAsB,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAE7D,SAAS,cAAc,CAAC,YAAoC,EAAE;IAC5D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAC9D,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;SAC7D;QACD,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,EAAE;SACb;KACc,CAAC;AACpB,CAAC;AAED,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,kDAAkD;IAClD,IAAI,OAAY,CAAC;IACjB,kDAAkD;IAClD,IAAI,QAAa,CAAC;IAElB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAU,CAAC,CAAC;QAC5E,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtD,YAAY,CAAC,eAAe,CAAC,cAAuB,CAAC,CAAC;QACtD,kBAAkB,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,kBAAkB,CAAC,eAAe,CAAC,SAA8B,CAAC,CAAC;QAEnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAEvF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,GAAG,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAkB,CAAC,CAAC;QAC9F,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAEvF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/review.pr-jenkins.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 3.3 — Jenkins + GitHub composition scenario.
+ *
+ * Simulates a CI/Jenkins run of `ghagga review --pr N --output sarif`:
+ *   - GITHUB_TOKEN env is set (no interactive login) → the post-back resolves it
+ *     and posts the summary via the forge adapter.
+ *   - `--output sarif` still emits SARIF (buildSarif) — the two outputs coexist.
+ *   - issue-export stays CLI-local: createIssue/ensureLabel are the SAME
+ *     github-api.ts functions, untouched by the PR path.
+ *
+ * We assemble the exact building blocks reviewCommand composes (token resolution
+ * → adapter post-back, buildSarif, github-api issue fns) rather than driving the
+ * full LLM pipeline, so the scenario is deterministic and offline.
+ */
+export {};
+//# sourceMappingURL=review.pr-jenkins.test.d.ts.map

package/dist/commands/review.pr-jenkins.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.pr-jenkins.test.d.ts","sourceRoot":"","sources":["../../src/commands/review.pr-jenkins.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/commands/review.pr-jenkins.test.js

@@ -0,0 +1,106 @@
+/**
+ * 3.3 — Jenkins + GitHub composition scenario.
+ *
+ * Simulates a CI/Jenkins run of `ghagga review --pr N --output sarif`:
+ *   - GITHUB_TOKEN env is set (no interactive login) → the post-back resolves it
+ *     and posts the summary via the forge adapter.
+ *   - `--output sarif` still emits SARIF (buildSarif) — the two outputs coexist.
+ *   - issue-export stays CLI-local: createIssue/ensureLabel are the SAME
+ *     github-api.ts functions, untouched by the PR path.
+ *
+ * We assemble the exact building blocks reviewCommand composes (token resolution
+ * → adapter post-back, buildSarif, github-api issue fns) rather than driving the
+ * full LLM pipeline, so the scenario is deterministic and offline.
+ */
+import { buildSarif, formatReviewComment, REVIEW_COMMENT_MARKER, } from 'ghagga-core';
+import { GitHubForgeAdapter, StaticTokenProvider } from 'ghagga-forge';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createCliGitHubClientPort } from '../lib/cli-github-client-port.js';
+import * as githubApi from '../lib/github-api.js';
+import { postSummaryComment } from '../lib/pr-postback.js';
+import { resolvePrToken } from '../lib/pr-token.js';
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+function jsonResponse(status, body) {
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        statusText: 'OK',
+        text: () => Promise.resolve(JSON.stringify(body)),
+        json: () => Promise.resolve(body),
+    };
+}
+function makeResult() {
+    return {
+        status: 'PASSED',
+        summary: 'Looks good',
+        findings: [
+            { severity: 'high', category: 'security', file: 'src/a.ts', message: 'x', source: 'ai' },
+        ],
+        staticAnalysis: {
+            semgrep: { status: 'success', findings: [], executionTimeMs: 1 },
+            trivy: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            cpd: { status: 'skipped', findings: [], executionTimeMs: 0 },
+        },
+        memoryContext: null,
+        metadata: {
+            mode: 'simple',
+            provider: 'gateway',
+            model: 'gpt-4o-mini',
+            tokensUsed: 1,
+            executionTimeMs: 1000,
+            toolsRun: [],
+            toolsSkipped: [],
+            fileList: ['src/a.ts'],
+        },
+    };
+}
+describe('3.3 Jenkins+GitHub: --pr post-back + SARIF coexist; issue-export CLI-local', () => {
+    const ORIGINAL_ENV = { ...process.env };
+    beforeEach(() => {
+        mockFetch.mockReset();
+        process.env.GITHUB_TOKEN = 'jenkins-token';
+        process.env.GH_TOKEN = undefined;
+    });
+    afterEach(() => {
+        process.env = { ...ORIGINAL_ENV };
+    });
+    it('GITHUB_TOKEN drives the adapter PR post AND SARIF still renders', async () => {
+        const result = makeResult();
+        // ── (a) Token resolution prefers the CI env var ───────────
+        const token = resolvePrToken();
+        expect(token).toBe('jenkins-token');
+        // ── (b) SARIF output still emits independently ────────────
+        const sarif = buildSarif(result, '3.0.0');
+        expect(sarif.runs).toBeDefined();
+        expect(Array.isArray(sarif.runs)).toBe(true);
+        // ── (c) Post-back via the forge adapter (mocked GitHub) ───
+        mockFetch.mockResolvedValueOnce(jsonResponse(200, [])); // find: none
+        mockFetch.mockResolvedValueOnce(jsonResponse(201, { id: 7777 })); // post
+        const provider = new StaticTokenProvider(token);
+        const adapter = new GitHubForgeAdapter({
+            client: createCliGitHubClientPort(),
+            token: await provider.getToken(),
+            owner: 'acme',
+            repo: 'ci',
+        });
+        const body = formatReviewComment(result, { fileList: result.metadata.fileList });
+        const postRes = await postSummaryComment(adapter, { repo: { kind: 'github', nativeId: 'acme/ci', path: 'acme/ci' }, iid: 88 }, body, { html: REVIEW_COMMENT_MARKER });
+        expect(postRes.createdNativeId).toBe(7777);
+        // Body carries the marker (parity with server PR comment).
+        const [, postInit] = mockFetch.mock.calls[1];
+        expect(JSON.parse(postInit.body).body).toContain(REVIEW_COMMENT_MARKER);
+    });
+    it('issue-export functions are the SAME CLI-local github-api fns (untouched)', () => {
+        // The PR path imports the forge adapter; issue-export remains the local
+        // github-api.ts createIssue/createComment/ensureLabel — verify identity.
+        expect(typeof githubApi.createIssue).toBe('function');
+        expect(typeof githubApi.createComment).toBe('function');
+        expect(typeof githubApi.ensureLabel).toBe('function');
+        // These are NOT routed through the forge adapter (they hit /issues, /labels
+        // directly). Confirm the module still exposes the original public surface.
+        expect(githubApi.createIssue.name).toBe('createIssue');
+        expect(githubApi.ensureLabel.name).toBe('ensureLabel');
+    });
+});
+//# sourceMappingURL=review.pr-jenkins.test.js.map

package/dist/commands/review.pr-jenkins.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.pr-jenkins.test.js","sourceRoot":"","sources":["../../src/commands/review.pr-jenkins.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAElC,SAAS,YAAY,CAAC,MAAc,EAAE,IAAa;IACjD,OAAO;QACL,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QACjC,MAAM;QACN,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KACtB,CAAC;AAChB,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE;YACR,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;SACzF;QACD,cAAc,EAAE;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAC9D,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;SAC7D;QACD,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,aAAa;YACpB,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI;YACrB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,4EAA4E,EAAE,GAAG,EAAE;IAC1F,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAExC,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,eAAe,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,SAA8B,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,6DAA6D;QAC7D,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEpC,6DAA6D;QAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAwB,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7C,6DAA6D;QAC7D,SAAS,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa;QACrE,SAAS,CAAC,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;QAEzE,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC,KAAe,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;YACrC,MAAM,EAAE,yBAAyB,EAAE;YACnC,KAAK,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE;YAChC,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,OAAO,EACP,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAC3E,IAAI,EACJ,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,2DAA2D;QAC3D,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA0B,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAc,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,CAAC,OAAO,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/review.pr-nativeid-fallback.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * FIX 4 (4vr backlog-cleanup) — CLI `--pr` flow: when the numeric repo-id
+ * resolution (`GET /repos/{owner}/{repo}`) fails with a NETWORK error, the
+ * post-back must DEGRADE gracefully:
+ *   - it does NOT crash,
+ *   - it warns (non-silent),
+ *   - it proceeds with a PATH-SHAPED, opaque `RepoRef.nativeId` (`owner/repo`).
+ *
+ * This locks in the safe-degradation documented by the RepoRef.nativeId contract
+ * (opaque identity string, MAY be path-shaped). We mock the seams reviewCommand
+ * composes so the test is deterministic + offline, and capture the `RepoRef`
+ * handed to the post-back to assert the fallback nativeId.
+ */
+export {};
+//# sourceMappingURL=review.pr-nativeid-fallback.test.d.ts.map

package/dist/commands/review.pr-nativeid-fallback.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.pr-nativeid-fallback.test.d.ts","sourceRoot":"","sources":["../../src/commands/review.pr-nativeid-fallback.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}