github-issue-tower-defence-management 1.148.25 → 1.149.0

package/src/domain/usecases/DailySecurityScanUseCase.test.ts

@@ -2,6 +2,7 @@ import { DailySecurityScanUseCase } from './DailySecurityScanUseCase';
 import { LocalCommandRunner } from './adapter-interfaces/LocalCommandRunner';
 import { IssueRepository } from './adapter-interfaces/IssueRepository';
 import { HttpRepository } from './adapter-interfaces/HttpRepository';
+import { KevReportWatermarkRepository } from './adapter-interfaces/KevReportWatermarkRepository';
 import { mock } from 'jest-mock-extended';
 
 const KEV_CATALOG_URL =
@@ -12,16 +13,21 @@ describe('DailySecurityScanUseCase', () => {
     const mockLocalCommandRunner = mock<LocalCommandRunner>();
     const mockIssueRepository = mock<IssueRepository>();
     const mockHttpRepository = mock<HttpRepository>();
+    const mockKevReportWatermarkRepository =
+      mock<KevReportWatermarkRepository>();
+    mockKevReportWatermarkRepository.load.mockResolvedValue({ type: 'absent' });
     const useCase = new DailySecurityScanUseCase(
       mockLocalCommandRunner,
       mockIssueRepository,
       mockHttpRepository,
+      mockKevReportWatermarkRepository,
     );
     return {
       useCase,
       mockLocalCommandRunner,
       mockIssueRepository,
       mockHttpRepository,
+      mockKevReportWatermarkRepository,
     };
   };
 
@@ -1238,5 +1244,209 @@ describe('DailySecurityScanUseCase', () => {
       );
       expect(grepCalls).toHaveLength(0);
     });
+
+    const scannedExampleLibrary = osvScanOutput([
+      {
+        name: 'example-library',
+        version: '1.2.3',
+        ecosystem: 'npm',
+        id: 'GHSA-1111-2222-3333',
+        aliases: ['CVE-2024-0001', 'CVE-2024-0002', 'CVE-2024-0003'],
+        summary: 'Example Library Deserialization',
+      },
+    ]);
+
+    const kevCatalogOf = (
+      vulnerabilities: { cveID: string; dateAdded: string }[],
+    ) => ({
+      vulnerabilities: vulnerabilities.map((vulnerability) => ({
+        cveID: vulnerability.cveID,
+        vendorProject: 'Example',
+        product: 'ExampleLibrary',
+        vulnerabilityName: `${vulnerability.cveID} Deserialization`,
+        dateAdded: vulnerability.dateAdded,
+      })),
+    });
+
+    it('records every addition it considered in the watermark after the report issue is created', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([
+            { cveID: 'CVE-2024-0001', dateAdded: '2024-01-01' },
+            { cveID: 'CVE-2024-0002', dateAdded: '2024-01-02' },
+          ]),
+        );
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(1);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0002'],
+          },
+        ],
+      ]);
+    });
+
+    it('does not report an addition that the stored watermark already covers', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0001'],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+    });
+
+    it('reports an addition sharing the stored watermark date that was not reported before', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([
+            { cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' },
+            { cveID: 'CVE-2024-0002', dateAdded: '2024-01-02' },
+          ]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0001'],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      const kevCalls = kevReportCalls(
+        mockIssueRepository.createNewIssue.mock.calls,
+      );
+      expect(kevCalls).toHaveLength(1);
+      expect(kevCalls[0][3]).toContain('CVE-2024-0002');
+      expect(kevCalls[0][3]).not.toContain('CVE-2024-0001');
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: [
+              'CVE-2024-0001',
+              'CVE-2024-0002',
+            ],
+          },
+        ],
+      ]);
+    });
+
+    it('does not select an addition dated strictly before the stored watermark date', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-01' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: [],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+    });
+
+    it('advances the watermark over an addition that affects no scanned package so it is not weighed again', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-9999', dateAdded: '2024-01-02' }]),
+        );
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-9999'],
+          },
+        ],
+      ]);
+    });
+
+    it('skips the report and leaves the watermark untouched when the stored watermark is unreadable', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'unreadable',
+        reason: 'the stored watermark file holds malformed JSON',
+      });
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'the stored watermark file holds malformed JSON',
+        ),
+      );
+      errorSpy.mockRestore();
+    });
+
+    it('creates the report issue and logs when the watermark write fails, so the same additions are weighed again', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.save.mockRejectedValue(
+        new Error('disk is read-only'),
+      );
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(1);
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('disk is read-only'),
+      );
+      errorSpy.mockRestore();
+    });
   });
 });

package/src/domain/usecases/DailySecurityScanUseCase.ts

@@ -1,6 +1,8 @@
 import { LocalCommandRunner } from './adapter-interfaces/LocalCommandRunner';
 import { IssueRepository } from './adapter-interfaces/IssueRepository';
 import { HttpRepository } from './adapter-interfaces/HttpRepository';
+import { KevReportWatermarkRepository } from './adapter-interfaces/KevReportWatermarkRepository';
+import { KevReportWatermark } from '../entities/KevReportWatermark';
 import { Member } from '../entities/Member';
 
 export type DailySecurityScanConfig = {
@@ -122,6 +124,40 @@ const renderScannerFindings = (
 const KEV_CATALOG_URL =
   'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
 
+const dayBeforeUtcYmd = (date: Date): string => {
+  const dayBefore = new Date(date);
+  dayBefore.setUTCDate(dayBefore.getUTCDate() - 1);
+  return dayBefore.toISOString().slice(0, 10);
+};
+
+const advanceWatermark = (
+  storedWatermark: KevReportWatermark | null,
+  reportedVulnerabilities: KevVulnerability[],
+): KevReportWatermark => {
+  const lastReportedDateAdded = reportedVulnerabilities.reduce(
+    (latest, vulnerability) =>
+      vulnerability.dateAdded > latest ? vulnerability.dateAdded : latest,
+    storedWatermark === null ? '' : storedWatermark.lastReportedDateAdded,
+  );
+  const reportedCveIdsOnLastReportedDateAdded = new Set<string>(
+    storedWatermark !== null &&
+      storedWatermark.lastReportedDateAdded === lastReportedDateAdded
+      ? storedWatermark.reportedCveIdsOnLastReportedDateAdded
+      : [],
+  );
+  for (const vulnerability of reportedVulnerabilities) {
+    if (vulnerability.dateAdded === lastReportedDateAdded) {
+      reportedCveIdsOnLastReportedDateAdded.add(vulnerability.cveID);
+    }
+  }
+  return {
+    lastReportedDateAdded,
+    reportedCveIdsOnLastReportedDateAdded: Array.from(
+      reportedCveIdsOnLastReportedDateAdded,
+    ),
+  };
+};
+
 export class DailySecurityScanUseCase {
   constructor(
     readonly localCommandRunner: LocalCommandRunner,
@@ -130,6 +166,7 @@ export class DailySecurityScanUseCase {
       'createNewIssue' | 'searchIssue' | 'createCommentByUrl'
     >,
     readonly httpRepository: HttpRepository,
+    readonly kevReportWatermarkRepository: KevReportWatermarkRepository,
   ) {}
 
   run = async (input: {
@@ -344,9 +381,26 @@ export class DailySecurityScanUseCase {
       return;
     }
 
-    const yesterday = new Date(lastTargetDate);
-    yesterday.setUTCDate(yesterday.getUTCDate() - 1);
-    const yesterdayYmd = yesterday.toISOString().slice(0, 10);
+    const watermarkLoadResult = await this.kevReportWatermarkRepository.load();
+    if (watermarkLoadResult.type === 'unreadable') {
+      console.error(
+        `Skipping the CISA KEV report for this run because ${watermarkLoadResult.reason}. The stored watermark is left unchanged and no issue was created; reporting resumes once the stored watermark is readable again.`,
+      );
+      return;
+    }
+    const storedWatermark =
+      watermarkLoadResult.type === 'stored'
+        ? watermarkLoadResult.watermark
+        : null;
+    const reportBoundaryDateAdded =
+      storedWatermark === null
+        ? dayBeforeUtcYmd(lastTargetDate)
+        : storedWatermark.lastReportedDateAdded;
+    const alreadyReportedCveIdsOnBoundary = new Set<string>(
+      storedWatermark === null
+        ? []
+        : storedWatermark.reportedCveIdsOnLastReportedDateAdded,
+    );
 
     const kevJson = await this.httpRepository.get(KEV_CATALOG_URL);
     const parsedKev: unknown = JSON.parse(kevJson);
@@ -356,10 +410,30 @@ export class DailySecurityScanUseCase {
       );
     }
 
-    const newKevEntries = parsedKev.vulnerabilities.filter(
-      (vulnerability) => vulnerability.dateAdded >= yesterdayYmd,
+    const unreportedVulnerabilities = parsedKev.vulnerabilities.filter(
+      (vulnerability) =>
+        vulnerability.dateAdded > reportBoundaryDateAdded ||
+        (vulnerability.dateAdded === reportBoundaryDateAdded &&
+          !alreadyReportedCveIdsOnBoundary.has(vulnerability.cveID)),
+    );
+    if (unreportedVulnerabilities.length === 0) {
+      return;
+    }
+    const advancedWatermark = advanceWatermark(
+      storedWatermark,
+      unreportedVulnerabilities,
     );
-    const affectingKevEntries = newKevEntries
+    const saveAdvancedWatermark = async (): Promise<void> => {
+      try {
+        await this.kevReportWatermarkRepository.save(advancedWatermark);
+      } catch (error) {
+        console.error(
+          `The CISA KEV additions considered in this run were not recorded because the KEV report watermark file did not advance to ${advancedWatermark.lastReportedDateAdded}: ${String(error)}. Those additions will be considered again on the next run, and the rest of the scheduled work continues.`,
+        );
+      }
+    };
+
+    const affectingKevEntries = unreportedVulnerabilities
       .map((vulnerability) => ({
         vulnerability,
         affectedPackages: scannedVulnerablePackages.filter((scannedPackage) =>
@@ -368,13 +442,14 @@ export class DailySecurityScanUseCase {
       }))
       .filter((entry) => entry.affectedPackages.length > 0);
     if (affectingKevEntries.length === 0) {
+      await saveAdvancedWatermark();
       return;
     }
 
     await this.issueRepository.createNewIssue(
       org,
       config.kevReportRepo,
-      `CISA KEV new additions since ${yesterdayYmd}`,
+      `CISA KEV new additions since ${reportBoundaryDateAdded}`,
       affectingKevEntries
         .map((entry) =>
           [
@@ -389,5 +464,7 @@ export class DailySecurityScanUseCase {
       [manager],
       [],
     );
+
+    await saveAdvancedWatermark();
   };
 }

package/src/domain/usecases/DefaultSilentSessionMessageComposer.test.ts

@@ -15,6 +15,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const section = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
@@ -23,6 +24,45 @@ describe('DefaultSilentSessionMessageComposer', () => {
     expect(section).toContain(SILENT_SESSION_REMINDER_SENTINEL);
   });
 
+  it('embeds the reminder sentinel in the unconsumed-result section', () => {
+    const section = composer.composeSubAgentUnconsumedResultSection([
+      {
+        label: 'agent-aaabbbbcccc30001',
+        silentSeconds: 5220,
+        runningSeconds: 5400,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+    ]);
+    expect(section).toContain(SILENT_SESSION_REMINDER_SENTINEL);
+  });
+
+  it('names every finished sub-agent and the whole minutes its result has stayed unconsumed', () => {
+    const section = composer.composeSubAgentUnconsumedResultSection([
+      {
+        label: 'agent-aaabbbbcccc30001',
+        silentSeconds: 5220,
+        runningSeconds: 5400,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+      {
+        label: 'agent-aaabbbbcccc30002',
+        silentSeconds: 359,
+        runningSeconds: 900,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+    ]);
+    expect(section).toContain('This is an automated status check.');
+    expect(section).toContain(
+      'agent-aaabbbbcccc30001: result unconsumed for 87m',
+    );
+    expect(section).toContain(
+      'agent-aaabbbbcccc30002: result unconsumed for 5m',
+    );
+  });
+
   it('renders the main-stalled message as a neutral automated status notice with the silent minutes substituted', () => {
     const section = composer.composeMainStalledSection(600);
     expect(section).toContain('This is an automated status check.');
@@ -148,6 +188,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const section = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
@@ -258,6 +299,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [],
@@ -277,6 +319,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [],
@@ -296,6 +339,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [],
@@ -317,6 +361,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 30,
           runningSeconds: 1200,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
     });
@@ -340,6 +385,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 30,
           runningSeconds: 1200,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
     });
@@ -353,6 +399,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const section = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
@@ -374,6 +421,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [
@@ -382,6 +430,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 10,
           runningSeconds: 960,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
     });
@@ -411,6 +460,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const composedDefaultTexts = [
       composer.composeMainStalledSection(600),
@@ -419,6 +469,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
         idleSubAgents: [subAgent],
         longRunningSubAgents: [subAgent],
       }),
+      composer.composeSubAgentUnconsumedResultSection([subAgent]),
     ];
     for (const text of composedDefaultTexts) {
       for (const pattern of flaggedPatterns) {
@@ -435,6 +486,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const composedDefaultTexts = [
       composer.composeMainStalledSection(600),
@@ -443,6 +495,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
         idleSubAgents: [subAgent],
         longRunningSubAgents: [subAgent],
       }),
+      composer.composeSubAgentUnconsumedResultSection([subAgent]),
     ];
     for (const text of composedDefaultTexts) {
       expect(text).not.toContain('<');
@@ -462,12 +515,16 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const subSection = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
       longRunningSubAgents: [subAgent],
     });
-    const combined = `${mainSection}\n${subSection}`.toLowerCase();
+    const unconsumedResultSection =
+      composer.composeSubAgentUnconsumedResultSection([subAgent]);
+    const combined =
+      `${mainSection}\n${subSection}\n${unconsumedResultSection}`.toLowerCase();
     expect(combined).not.toContain('claude');
     expect(combined).not.toContain('take ownership');
     expect(combined).not.toContain('/home/');

package/src/domain/usecases/DefaultSilentSessionMessageComposer.ts

@@ -42,6 +42,22 @@ const composeLongRunningSubAgentSection = (
   ].join('\n');
 };
 
+const composeUnconsumedResultSubAgentSection = (
+  unconsumedResultSubAgents: SubAgentActivity[],
+): string => {
+  const lines = unconsumedResultSubAgents.map(
+    (subAgent) =>
+      `- ${subAgent.label}: result unconsumed for ${formatMinutes(
+        subAgent.silentSeconds,
+      )}`,
+  );
+  return [
+    `${SILENT_SESSION_REMINDER_SENTINEL} This is an automated status check. The following sub-process(es) have finished and their results have been waiting unread for about the minutes shown:`,
+    ...lines,
+    'For each one: please read its result, act on it, and then mark the sub-process as finished so it is no longer tracked as running. If you have already acted on the result, marking it finished is all that remains.',
+  ].join('\n');
+};
+
 export const composeOwnerCallFormatGuidance = (): string => {
   return 'Please share it through a new owner-call in the format documented for this session, written to be self-contained so the owner can understand the situation from that single message.';
 };
@@ -98,4 +114,9 @@ export class DefaultSilentSessionMessageComposer implements SilentSessionMessage
     }
     return sections.join('\n\n');
   };
+
+  composeSubAgentUnconsumedResultSection = (
+    unconsumedResultSubAgents: SubAgentActivity[],
+  ): string =>
+    composeUnconsumedResultSubAgentSection(unconsumedResultSubAgents);
 }