ghagga 3.0.0 → 3.2.0

package/dist/commands/review.mr-exit.test.js

@@ -0,0 +1,190 @@
+/**
+ * P4 — `ghagga review --mr N` (GitLab MR) post-back routes through the SHARED
+ * composition helper (composeForgePostback → postSummaryComment) and honors the
+ * SAME blocking-by-default exit semantics as `--pr` (FIX 3). `--pr-soft-fail`
+ * (shared) opts out.
+ *
+ * We mock the seams reviewCommand composes (pipeline, git, gitlab-token,
+ * gitlab-api, gitlab client port, post-back, core formatters) so these tests are
+ * deterministic + offline, and assert the resolved process exit code + that the
+ * GitLab adapter is the one constructed (shared helper routes --mr to GitLab).
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+vi.mock('ghagga-core', () => ({
+    reviewPipeline: vi.fn(),
+    buildSarif: vi.fn().mockReturnValue({ version: '2.1.0', runs: [] }),
+    formatReviewComment: vi.fn().mockReturnValue('<!-- ghagga-review -->\nbody'),
+    formatBoxSummary: vi.fn().mockReturnValue([]),
+    REVIEW_COMMENT_MARKER: '<!-- ghagga-review -->',
+    DEFAULT_SETTINGS: {
+        enableSemgrep: true,
+        enableTrivy: true,
+        enableCpd: true,
+        enableMemory: true,
+        customRules: [],
+        ignorePatterns: [],
+        reviewLevel: 'normal',
+        enabledTools: [],
+        disabledTools: [],
+    },
+    DEFAULT_MODELS: { gateway: 'auto', 'cli-bridge': 'auto', ollama: 'llama3' },
+    initializeDefaultTools: vi.fn(),
+    toolRegistry: { getAll: vi.fn().mockReturnValue([]) },
+    EngramMemoryStorage: { create: vi.fn() },
+    SqliteMemoryStorage: { create: vi.fn() },
+    formatReviewResult: vi.fn(),
+}));
+vi.mock('node:child_process', () => ({ execSync: vi.fn() }));
+vi.mock('node:fs', () => ({ readFileSync: vi.fn(), existsSync: vi.fn().mockReturnValue(false) }));
+vi.mock('../lib/gitlab-token.js', () => ({ resolveMrToken: vi.fn() }));
+vi.mock('../lib/pr-postback.js', () => ({ postSummaryComment: vi.fn() }));
+vi.mock('../lib/gitlab-api.js', () => ({
+    parseGitLabRemote: vi.fn().mockReturnValue({ host: 'gitlab.com', projectPath: 'acme/widgets' }),
+    GitLabApiError: class extends Error {
+    },
+}));
+vi.mock('../lib/cli-gitlab-client-port.js', () => ({
+    createCliGitLabClientPort: vi.fn(),
+    resolveGitLabApiBase: vi.fn().mockReturnValue('https://gitlab.com/api/v4'),
+    resolveGitLabProjectId: vi.fn().mockResolvedValue('12345'),
+}));
+// Track which adapter the shared helper constructs (routing proof).
+const gitlabCtor = vi.fn();
+const githubCtor = vi.fn();
+vi.mock('ghagga-forge', () => ({
+    GitHubForgeAdapter: class {
+        constructor(deps) {
+            githubCtor(deps);
+        }
+    },
+    GitLabForgeAdapter: class {
+        constructor(deps) {
+            gitlabCtor(deps);
+        }
+    },
+    StaticTokenProvider: class {
+        async getToken() {
+            return 'glpat';
+        }
+    },
+}));
+vi.mock('../lib/cli-github-client-port.js', () => ({ createCliGitHubClientPort: vi.fn() }));
+import { execSync } from 'node:child_process';
+import { reviewPipeline } from 'ghagga-core';
+import { resolveGitLabProjectId } from '../lib/cli-gitlab-client-port.js';
+import { resolveMrToken } from '../lib/gitlab-token.js';
+import { postSummaryComment } from '../lib/pr-postback.js';
+const mockExecSync = vi.mocked(execSync);
+const mockReviewPipeline = vi.mocked(reviewPipeline);
+const mockResolveMrToken = vi.mocked(resolveMrToken);
+const mockPostSummaryComment = vi.mocked(postSummaryComment);
+const mockResolveProjectId = vi.mocked(resolveGitLabProjectId);
+function defaultOptions(overrides = {}) {
+    return {
+        mode: 'simple',
+        provider: 'gateway',
+        model: 'm',
+        apiKey: 'k',
+        semgrep: true,
+        trivy: true,
+        cpd: true,
+        memory: false,
+        verbose: false,
+        disableTools: [],
+        enableTools: [],
+        ...overrides,
+    };
+}
+function passedResult() {
+    return {
+        status: 'PASSED',
+        summary: 'ok',
+        findings: [],
+        staticAnalysis: {
+            semgrep: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            trivy: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            cpd: { status: 'skipped', findings: [], executionTimeMs: 0 },
+        },
+        memoryContext: null,
+        metadata: {
+            mode: 'simple',
+            provider: 'gateway',
+            model: 'm',
+            tokensUsed: 1,
+            executionTimeMs: 1,
+            toolsRun: [],
+            toolsSkipped: [],
+            fileList: [],
+        },
+    };
+}
+describe('reviewCommand — --mr post-back (P4, shared composition helper)', () => {
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let exitSpy;
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let errorSpy;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => { }));
+        errorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+        mockExecSync.mockReturnValue('git@gitlab.com:acme/widgets.git');
+        mockReviewPipeline.mockResolvedValue(passedResult());
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('--mr success → posts via the GitLab adapter through the SHARED helper, exit 0', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 77, deletedNativeIds: [] });
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        // Routing proof: GitLab adapter constructed, NOT GitHub; ref via numeric id.
+        expect(gitlabCtor).toHaveBeenCalledOnce();
+        expect(githubCtor).not.toHaveBeenCalled();
+        expect(gitlabCtor).toHaveBeenCalledWith(expect.objectContaining({ projectId: '12345' }));
+        expect(mockResolveProjectId).toHaveBeenCalledWith('acme/widgets', 'glpat', 'https://gitlab.com/api/v4');
+        // Post routed through the shared forge-neutral postSummaryComment.
+        expect(mockPostSummaryComment).toHaveBeenCalledOnce();
+        expect(exitSpy).toHaveBeenCalledWith(0);
+    });
+    it('--mr + post-back throws → exit NON-ZERO (1) even when review PASSED', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitLab 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+    it('--mr + missing token → exit NON-ZERO (1) with a GitLab-specific message', async () => {
+        mockResolveMrToken.mockReturnValue(null);
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--mr requires a GitLab token'));
+    });
+    it('--mr + --pr-soft-fail + throws → WARNS and exits 0', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitLab 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, prSoftFail: true, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(0);
+    });
+    it('both --pr AND --mr → defensive guard exits 1 BEFORE the pipeline runs (FIX D)', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 3, mr: 7, outputFormat: 'sarif' }));
+        // The guard fires FIRST: the first recorded exit is the guard's non-zero exit
+        // (in production process.exit terminates here; the test mock lets it fall
+        // through, so we assert on the FIRST exit call specifically).
+        expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    });
+    it('does NOT mask a review-found-issues exit: --mr success + FAILED review → exit 1', async () => {
+        mockReviewPipeline.mockResolvedValue({ ...passedResult(), status: 'FAILED' });
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 77, deletedNativeIds: [] });
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+});
+//# sourceMappingURL=review.mr-exit.test.js.map

package/dist/commands/review.mr-exit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.mr-exit.test.js","sourceRoot":"","sources":["../../src/commands/review.mr-exit.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnE,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,8BAA8B,CAAC;IAC5E,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IAC7C,qBAAqB,EAAE,wBAAwB;IAC/C,gBAAgB,EAAE;QAChB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;KAClB;IACD,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3E,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE;IACrD,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC5B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAElG,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC/F,cAAc,EAAE,KAAM,SAAQ,KAAK;KAAG;CACvC,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE;IAClC,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,2BAA2B,CAAC;IAC1E,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;CAC3D,CAAC,CAAC,CAAC;AAEJ,oEAAoE;AACpE,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC3B,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,kBAAkB,EAAE;QAClB,YAAY,IAAa;YACvB,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;KACF;IACD,kBAAkB,EAAE;QAClB,YAAY,IAAa;YACvB,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,KAAK,CAAC,QAAQ;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;KACF;CACF,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE5F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAG3D,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,sBAAsB,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC7D,MAAM,oBAAoB,GAAG,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,YAAoC,EAAE;IAC5D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAC9D,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;SAC7D;QACD,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,EAAE;SACb;KACc,CAAC;AACpB,CAAC;AAED,QAAQ,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC9E,kDAAkD;IAClD,IAAI,OAAY,CAAC;IACjB,kDAAkD;IAClD,IAAI,QAAa,CAAC;IAElB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAU,CAAC,CAAC;QAC5E,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtD,YAAY,CAAC,eAAe,CAAC,iCAA0C,CAAC,CAAC;QACzE,kBAAkB,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,6EAA6E;QAC7E,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,oBAAoB,CAAC,CAAC,oBAAoB,CAC/C,cAAc,EACd,OAAO,EACP,2BAA2B,CAC5B,CAAC;QACF,mEAAmE;QACnE,MAAM,CAAC,sBAAsB,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE7F,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAElF,8EAA8E;QAC9E,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,GAAG,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAkB,CAAC,CAAC;QAC9F,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/review.postback-disclosure.test.d.ts

@@ -0,0 +1,22 @@
+/**
+ * SECURITY HYGIENE — before the CLI posts a review back to a forge (`--pr` GitHub
+ * PR / `--mr` GitLab MR), it discloses the DESTINATION HOST on stderr so the user
+ * sees where their token is going BEFORE the network POST fires.
+ *
+ * Rationale: the GitLab API base is derived from the git remote host, so a
+ * poisoned `origin` could exfiltrate GITLAB_TOKEN. Disclosing the REAL resolved
+ * host makes that visible.
+ *
+ * These tests assert:
+ *   - the disclosure line is emitted to STDERR (console.error), NOT stdout
+ *     (stdout is reserved for SARIF / JSON / markdown output)
+ *   - the host is correct for --pr (api.github.com) and --mr (gitlab.com)
+ *   - a self-hosted GitLab remote discloses THAT host (real resolution, not a
+ *     mock) — this is the poisoned-origin-visible case
+ *
+ * For the GitLab path we deliberately use the REAL parseGitLabRemote +
+ * resolveGitLabApiBase (only the network seams are mocked) so the host shown is
+ * the genuinely-resolved destination.
+ */
+export {};
+//# sourceMappingURL=review.postback-disclosure.test.d.ts.map

package/dist/commands/review.postback-disclosure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.postback-disclosure.test.d.ts","sourceRoot":"","sources":["../../src/commands/review.postback-disclosure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/commands/review.postback-disclosure.test.js

@@ -0,0 +1,192 @@
+/**
+ * SECURITY HYGIENE — before the CLI posts a review back to a forge (`--pr` GitHub
+ * PR / `--mr` GitLab MR), it discloses the DESTINATION HOST on stderr so the user
+ * sees where their token is going BEFORE the network POST fires.
+ *
+ * Rationale: the GitLab API base is derived from the git remote host, so a
+ * poisoned `origin` could exfiltrate GITLAB_TOKEN. Disclosing the REAL resolved
+ * host makes that visible.
+ *
+ * These tests assert:
+ *   - the disclosure line is emitted to STDERR (console.error), NOT stdout
+ *     (stdout is reserved for SARIF / JSON / markdown output)
+ *   - the host is correct for --pr (api.github.com) and --mr (gitlab.com)
+ *   - a self-hosted GitLab remote discloses THAT host (real resolution, not a
+ *     mock) — this is the poisoned-origin-visible case
+ *
+ * For the GitLab path we deliberately use the REAL parseGitLabRemote +
+ * resolveGitLabApiBase (only the network seams are mocked) so the host shown is
+ * the genuinely-resolved destination.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+vi.mock('ghagga-core', () => ({
+    reviewPipeline: vi.fn(),
+    buildSarif: vi.fn().mockReturnValue({ version: '2.1.0', runs: [] }),
+    formatReviewComment: vi.fn().mockReturnValue('<!-- ghagga-review -->\nbody'),
+    formatBoxSummary: vi.fn().mockReturnValue([]),
+    REVIEW_COMMENT_MARKER: '<!-- ghagga-review -->',
+    DEFAULT_SETTINGS: {
+        enableSemgrep: true,
+        enableTrivy: true,
+        enableCpd: true,
+        enableMemory: true,
+        customRules: [],
+        ignorePatterns: [],
+        reviewLevel: 'normal',
+        enabledTools: [],
+        disabledTools: [],
+    },
+    DEFAULT_MODELS: { gateway: 'auto', 'cli-bridge': 'auto', ollama: 'llama3' },
+    initializeDefaultTools: vi.fn(),
+    toolRegistry: { getAll: vi.fn().mockReturnValue([]) },
+    EngramMemoryStorage: { create: vi.fn() },
+    SqliteMemoryStorage: { create: vi.fn() },
+    formatReviewResult: vi.fn(),
+}));
+vi.mock('node:child_process', () => ({ execSync: vi.fn() }));
+vi.mock('node:fs', () => ({ readFileSync: vi.fn(), existsSync: vi.fn().mockReturnValue(false) }));
+// Token + post-back seams (network) are mocked; remote-parse + api-base are REAL.
+vi.mock('../lib/pr-token.js', () => ({ resolvePrToken: vi.fn() }));
+vi.mock('../lib/gitlab-token.js', () => ({ resolveMrToken: vi.fn() }));
+vi.mock('../lib/pr-postback.js', () => ({ postSummaryComment: vi.fn() }));
+vi.mock('../lib/github-api.js', () => ({
+    parseGitHubRemote: vi.fn().mockReturnValue({ owner: 'acme', repo: 'ci' }),
+    createComment: vi.fn(),
+    createIssue: vi.fn(),
+    ensureLabel: vi.fn(),
+    formatIssueBody: vi.fn(),
+}));
+// NOTE: gitlab-api.js (parseGitLabRemote) and the resolveGitLabApiBase host
+// derivation are NOT mocked — we want the REAL resolved host disclosed.
+vi.mock('../lib/cli-gitlab-client-port.js', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        createCliGitLabClientPort: vi.fn(),
+        resolveGitLabProjectId: vi.fn().mockResolvedValue('12345'),
+    };
+});
+vi.mock('ghagga-forge', () => ({
+    GitHubForgeAdapter: class {
+    },
+    GitLabForgeAdapter: class {
+    },
+    StaticTokenProvider: class {
+        async getToken() {
+            return 'tok';
+        }
+    },
+}));
+vi.mock('../lib/cli-github-client-port.js', () => ({ createCliGitHubClientPort: vi.fn() }));
+import { execSync } from 'node:child_process';
+import { reviewPipeline } from 'ghagga-core';
+import { resolveMrToken } from '../lib/gitlab-token.js';
+import { postSummaryComment } from '../lib/pr-postback.js';
+import { resolvePrToken } from '../lib/pr-token.js';
+const mockExecSync = vi.mocked(execSync);
+const mockReviewPipeline = vi.mocked(reviewPipeline);
+const mockResolvePrToken = vi.mocked(resolvePrToken);
+const mockResolveMrToken = vi.mocked(resolveMrToken);
+const mockPostSummaryComment = vi.mocked(postSummaryComment);
+function defaultOptions(overrides = {}) {
+    return {
+        mode: 'simple',
+        provider: 'gateway',
+        model: 'm',
+        apiKey: 'k',
+        semgrep: true,
+        trivy: true,
+        cpd: true,
+        memory: false,
+        verbose: false,
+        disableTools: [],
+        enableTools: [],
+        ...overrides,
+    };
+}
+function passedResult() {
+    return {
+        status: 'PASSED',
+        summary: 'ok',
+        findings: [],
+        staticAnalysis: {
+            semgrep: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            trivy: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            cpd: { status: 'skipped', findings: [], executionTimeMs: 0 },
+        },
+        memoryContext: null,
+        metadata: {
+            mode: 'simple',
+            provider: 'gateway',
+            model: 'm',
+            tokensUsed: 1,
+            executionTimeMs: 1,
+            toolsRun: [],
+            toolsSkipped: [],
+            fileList: [],
+        },
+    };
+}
+describe('reviewCommand — forge post-back DESTINATION HOST disclosure (stderr)', () => {
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let errorSpy;
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let logSpy;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.spyOn(process, 'exit').mockImplementation((() => { }));
+        errorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        logSpy = vi.spyOn(console, 'log').mockImplementation(() => { });
+        mockReviewPipeline.mockResolvedValue(passedResult());
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 77, deletedNativeIds: [] });
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    /** All console.error lines as one blob for substring assertions. */
+    function stderrBlob() {
+        return errorSpy.mock.calls.map((c) => String(c[0])).join('\n');
+    }
+    function stdoutBlob() {
+        return logSpy.mock.calls.map((c) => String(c[0])).join('\n');
+    }
+    it('--pr discloses api.github.com on stderr (not stdout), before the POST', async () => {
+        mockResolvePrToken.mockReturnValue('ghp');
+        mockExecSync.mockReturnValue('git@github.com:acme/ci.git');
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 3, outputFormat: 'sarif' }));
+        expect(stderrBlob()).toContain('→ Posting PR #3 review to api.github.com');
+        // MUST NOT pollute stdout (SARIF lives there).
+        expect(stdoutBlob()).not.toContain('Posting PR');
+        expect(stdoutBlob()).not.toContain('api.github.com');
+    });
+    it('--mr discloses the gitlab.com host on stderr (not stdout)', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockExecSync.mockReturnValue('git@gitlab.com:acme/widgets.git');
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        expect(stderrBlob()).toContain('→ Posting MR #7 review to gitlab.com');
+        expect(stdoutBlob()).not.toContain('Posting MR');
+        expect(stdoutBlob()).not.toContain('gitlab.com');
+    });
+    it('--mr on a SELF-HOSTED GitLab discloses THAT host (poisoned-origin visible)', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        // The git remote points at a self-managed/poisoned host — the disclosure must
+        // surface the REAL resolved API host, not a hardcoded gitlab.com.
+        mockExecSync.mockReturnValue('git@gitlab.internal.example:team/app.git');
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 42, outputFormat: 'sarif' }));
+        expect(stderrBlob()).toContain('→ Posting MR #42 review to gitlab.internal.example');
+        expect(stdoutBlob()).not.toContain('gitlab.internal.example');
+    });
+    it('the disclosure is emitted BEFORE the post (host shown even when the post throws)', async () => {
+        mockResolveMrToken.mockReturnValue('glpat');
+        mockExecSync.mockReturnValue('git@gitlab.com:acme/widgets.git');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitLab 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ mr: 7, outputFormat: 'sarif' }));
+        // Disclosure present even though the post failed afterwards.
+        expect(stderrBlob()).toContain('→ Posting MR #7 review to gitlab.com');
+    });
+});
+//# sourceMappingURL=review.postback-disclosure.test.js.map

package/dist/commands/review.postback-disclosure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.postback-disclosure.test.js","sourceRoot":"","sources":["../../src/commands/review.postback-disclosure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnE,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,8BAA8B,CAAC;IAC5E,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IAC7C,qBAAqB,EAAE,wBAAwB;IAC/C,gBAAgB,EAAE;QAChB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;KAClB;IACD,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3E,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE;IACrD,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC5B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAElG,kFAAkF;AAClF,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACnE,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;CACzB,CAAC,CAAC,CAAC;AACJ,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACnE,MAAM,MAAM,GAAG,MAAM,cAAc,EAAqD,CAAC;IACzF,OAAO;QACL,GAAG,MAAM;QACT,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE;QAClC,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;KAC3D,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,kBAAkB,EAAE;KAAQ;IAC5B,kBAAkB,EAAE;KAAQ;IAC5B,mBAAmB,EAAE;QACnB,KAAK,CAAC,QAAQ;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE5F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,sBAAsB,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAE7D,SAAS,cAAc,CAAC,YAAoC,EAAE;IAC5D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAC9D,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;SAC7D;QACD,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,EAAE;SACb;KACc,CAAC;AACpB,CAAC;AAED,QAAQ,CAAC,sEAAsE,EAAE,GAAG,EAAE;IACpF,kDAAkD;IAClD,IAAI,QAAa,CAAC;IAClB,kDAAkD;IAClD,IAAI,MAAW,CAAC;IAEhB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAU,CAAC,CAAC;QAClE,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnE,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/D,kBAAkB,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACrD,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,SAAS,UAAU;QACjB,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,SAAS,UAAU;QACjB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,YAAY,CAAC,eAAe,CAAC,4BAAqC,CAAC,CAAC;QAEpE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAC3E,+CAA+C;QAC/C,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,YAAY,CAAC,eAAe,CAAC,iCAA0C,CAAC,CAAC;QAEzE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,8EAA8E;QAC9E,kEAAkE;QAClE,YAAY,CAAC,eAAe,CAAC,0CAAmD,CAAC,CAAC;QAElF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,oDAAoD,CAAC,CAAC;QACrF,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,YAAY,CAAC,eAAe,CAAC,iCAA0C,CAAC,CAAC;QACzE,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE3E,6DAA6D;QAC7D,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/review.pr-exit.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * FIX 3 (P3 4vr) — `--pr` post-back failure must be BLOCKING by default.
+ *
+ * `--pr` is an explicitly-requested side-effect. In CI (Jenkins) a post-back
+ * that throws — or a missing token — must FAIL the job (non-zero exit), not
+ * silently exit 0. `--pr-soft-fail` restores the old non-blocking behavior.
+ *
+ * We mock the seams reviewCommand composes (pipeline, git, token, post-back,
+ * core formatters) so these tests are deterministic and offline, and assert the
+ * resolved process exit code.
+ */
+export {};
+//# sourceMappingURL=review.pr-exit.test.d.ts.map

package/dist/commands/review.pr-exit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.pr-exit.test.d.ts","sourceRoot":"","sources":["../../src/commands/review.pr-exit.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/commands/review.pr-exit.test.js

@@ -0,0 +1,162 @@
+/**
+ * FIX 3 (P3 4vr) — `--pr` post-back failure must be BLOCKING by default.
+ *
+ * `--pr` is an explicitly-requested side-effect. In CI (Jenkins) a post-back
+ * that throws — or a missing token — must FAIL the job (non-zero exit), not
+ * silently exit 0. `--pr-soft-fail` restores the old non-blocking behavior.
+ *
+ * We mock the seams reviewCommand composes (pipeline, git, token, post-back,
+ * core formatters) so these tests are deterministic and offline, and assert the
+ * resolved process exit code.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+// ─── Mock ghagga-core: only what review.ts touches on the --pr path ──
+vi.mock('ghagga-core', () => ({
+    reviewPipeline: vi.fn(),
+    buildSarif: vi.fn().mockReturnValue({ version: '2.1.0', runs: [] }),
+    formatReviewComment: vi.fn().mockReturnValue('<!-- ghagga-review -->\nbody'),
+    formatBoxSummary: vi.fn().mockReturnValue([]),
+    REVIEW_COMMENT_MARKER: '<!-- ghagga-review -->',
+    DEFAULT_SETTINGS: {
+        enableSemgrep: true,
+        enableTrivy: true,
+        enableCpd: true,
+        enableMemory: true,
+        customRules: [],
+        ignorePatterns: [],
+        reviewLevel: 'normal',
+        enabledTools: [],
+        disabledTools: [],
+    },
+    DEFAULT_MODELS: { gateway: 'auto', 'cli-bridge': 'auto', ollama: 'llama3' },
+    initializeDefaultTools: vi.fn(),
+    toolRegistry: { getAll: vi.fn().mockReturnValue([]) },
+    EngramMemoryStorage: { create: vi.fn() },
+    SqliteMemoryStorage: { create: vi.fn() },
+    formatReviewResult: vi.fn(),
+}));
+vi.mock('node:child_process', () => ({ execSync: vi.fn() }));
+vi.mock('node:fs', () => ({ readFileSync: vi.fn(), existsSync: vi.fn().mockReturnValue(false) }));
+// PR-token + remote-parse + post-back seams.
+vi.mock('../lib/pr-token.js', () => ({ resolvePrToken: vi.fn() }));
+vi.mock('../lib/pr-postback.js', () => ({ postSummaryComment: vi.fn() }));
+vi.mock('../lib/github-api.js', () => ({
+    parseGitHubRemote: vi.fn().mockReturnValue({ owner: 'acme', repo: 'ci' }),
+    createComment: vi.fn(),
+    createIssue: vi.fn(),
+    ensureLabel: vi.fn(),
+    formatIssueBody: vi.fn(),
+}));
+// The forge adapter + client port are constructed but never exercised (post-back
+// is mocked); stub them so construction is cheap.
+vi.mock('ghagga-forge', () => ({
+    GitHubForgeAdapter: class {
+    },
+    StaticTokenProvider: class {
+        async getToken() {
+            return 'tok';
+        }
+    },
+}));
+vi.mock('../lib/cli-github-client-port.js', () => ({ createCliGitHubClientPort: vi.fn() }));
+import { execSync } from 'node:child_process';
+import { reviewPipeline } from 'ghagga-core';
+import { postSummaryComment } from '../lib/pr-postback.js';
+import { resolvePrToken } from '../lib/pr-token.js';
+const mockExecSync = vi.mocked(execSync);
+const mockReviewPipeline = vi.mocked(reviewPipeline);
+const mockResolvePrToken = vi.mocked(resolvePrToken);
+const mockPostSummaryComment = vi.mocked(postSummaryComment);
+function defaultOptions(overrides = {}) {
+    return {
+        mode: 'simple',
+        provider: 'gateway',
+        model: 'm',
+        apiKey: 'k',
+        semgrep: true,
+        trivy: true,
+        cpd: true,
+        memory: false,
+        verbose: false,
+        disableTools: [],
+        enableTools: [],
+        ...overrides,
+    };
+}
+function passedResult() {
+    return {
+        status: 'PASSED',
+        summary: 'ok',
+        findings: [],
+        staticAnalysis: {
+            semgrep: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            trivy: { status: 'skipped', findings: [], executionTimeMs: 0 },
+            cpd: { status: 'skipped', findings: [], executionTimeMs: 0 },
+        },
+        memoryContext: null,
+        metadata: {
+            mode: 'simple',
+            provider: 'gateway',
+            model: 'm',
+            tokensUsed: 1,
+            executionTimeMs: 1,
+            toolsRun: [],
+            toolsSkipped: [],
+            fileList: [],
+        },
+    };
+}
+describe('reviewCommand — --pr post-back exit semantics (FIX 3)', () => {
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let exitSpy;
+    // biome-ignore lint/suspicious/noExplicitAny: spy
+    let errorSpy;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => { }));
+        errorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+        mockExecSync.mockReturnValue('diff content');
+        mockReviewPipeline.mockResolvedValue(passedResult());
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('--pr + post-back throws → exits NON-ZERO (1) even when review PASSED', async () => {
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitHub 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+    it('--pr + missing token → exits NON-ZERO (1) with a clear message', async () => {
+        mockResolvePrToken.mockReturnValue(undefined);
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--pr requires a GitHub token'));
+    });
+    it('--pr-soft-fail + post-back throws → WARNS and exits 0 (review PASSED)', async () => {
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockRejectedValue(new Error('GitHub 500'));
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, prSoftFail: true, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(0);
+    });
+    it('--pr success → exits 0 when review PASSED', async () => {
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 7, deletedNativeIds: [] });
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(0);
+    });
+    it('does NOT mask a review-found-issues exit: --pr success + FAILED review → exit 1', async () => {
+        mockReviewPipeline.mockResolvedValue({ ...passedResult(), status: 'FAILED' });
+        mockResolvePrToken.mockReturnValue('gh-token');
+        mockPostSummaryComment.mockResolvedValue({ createdNativeId: 7, deletedNativeIds: [] });
+        const { reviewCommand } = await import('./review.js');
+        await reviewCommand('.', defaultOptions({ pr: 42, outputFormat: 'sarif' }));
+        expect(exitSpy).toHaveBeenCalledWith(1);
+    });
+});
+//# sourceMappingURL=review.pr-exit.test.js.map

package/dist/commands/review.pr-exit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.pr-exit.test.js","sourceRoot":"","sources":["../../src/commands/review.pr-exit.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzE,wEAAwE;AACxE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnE,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,8BAA8B,CAAC;IAC5E,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IAC7C,qBAAqB,EAAE,wBAAwB;IAC/C,gBAAgB,EAAE;QAChB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;KAClB;IACD,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3E,sBAAsB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC/B,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE;IACrD,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC5B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAElG,6CAA6C;AAC7C,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACnE,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1E,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;CACzB,CAAC,CAAC,CAAC;AACJ,iFAAiF;AACjF,kDAAkD;AAClD,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,kBAAkB,EAAE;KAAQ;IAC5B,mBAAmB,EAAE;QACnB,KAAK,CAAC,QAAQ;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE5F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzC,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACrD,MAAM,sBAAsB,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAE7D,SAAS,cAAc,CAAC,YAAoC,EAAE;IAC5D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAChE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;YAC9D,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;SAC7D;QACD,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,EAAE;SACb;KACc,CAAC;AACpB,CAAC;AAED,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,kDAAkD;IAClD,IAAI,OAAY,CAAC;IACjB,kDAAkD;IAClD,IAAI,QAAa,CAAC;IAElB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAU,CAAC,CAAC;QAC5E,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtD,YAAY,CAAC,eAAe,CAAC,cAAuB,CAAC,CAAC;QACtD,kBAAkB,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,kBAAkB,CAAC,eAAe,CAAC,SAA8B,CAAC,CAAC;QAEnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE9F,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAEvF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,GAAG,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAkB,CAAC,CAAC;QAC9F,kBAAkB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAEvF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/review.pr-jenkins.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 3.3 — Jenkins + GitHub composition scenario.
+ *
+ * Simulates a CI/Jenkins run of `ghagga review --pr N --output sarif`:
+ *   - GITHUB_TOKEN env is set (no interactive login) → the post-back resolves it
+ *     and posts the summary via the forge adapter.
+ *   - `--output sarif` still emits SARIF (buildSarif) — the two outputs coexist.
+ *   - issue-export stays CLI-local: createIssue/ensureLabel are the SAME
+ *     github-api.ts functions, untouched by the PR path.
+ *
+ * We assemble the exact building blocks reviewCommand composes (token resolution
+ * → adapter post-back, buildSarif, github-api issue fns) rather than driving the
+ * full LLM pipeline, so the scenario is deterministic and offline.
+ */
+export {};
+//# sourceMappingURL=review.pr-jenkins.test.d.ts.map