github-issue-tower-defence-management 1.148.25 → 1.149.1

package/src/adapter/repositories/TranscriptSessionSubAgentActivityRepository.ts

@@ -344,6 +344,7 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
         filePath,
         fileName,
         nowEpochSeconds,
+        liveSubAgentIds !== null,
         loadNormalizedProcessCommandLines,
       );
       if (activity !== null) {
@@ -357,6 +358,7 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
     filePath: string,
     fileName: string,
     nowEpochSeconds: number,
+    listedInRunningSubAgentsRecord: boolean,
     loadNormalizedProcessCommandLines: () => Promise<string[]>,
   ): Promise<SubAgentActivity | null> => {
     let content: string;
@@ -368,7 +370,10 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
       return null;
     }
     const transcript = parseTranscript(content);
-    if (transcript.lastEntryIndicatesCompletion) {
+    if (
+      transcript.lastEntryIndicatesCompletion &&
+      !listedInRunningSubAgentsRecord
+    ) {
       return null;
     }
     const silentSeconds = clampToZero(
@@ -388,6 +393,7 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
           transcript.pendingToolCommands,
           loadNormalizedProcessCommandLines,
         )),
+      finishedResultUnconsumed: transcript.lastEntryIndicatesCompletion,
     };
   };
 

package/src/domain/entities/KevReportWatermark.ts

@@ -0,0 +1,4 @@
+export type KevReportWatermark = {
+  lastReportedDateAdded: string;
+  reportedCveIdsOnLastReportedDateAdded: string[];
+};

package/src/domain/entities/LiveSessionActivitySnapshot.ts

@@ -3,6 +3,7 @@ export type SubAgentActivity = {
   silentSeconds: number;
   runningSeconds: number;
   waitingOnExternalProcess: boolean;
+  finishedResultUnconsumed: boolean;
 };
 
 export type LiveSessionActivitySnapshot = {

package/src/domain/usecases/DailySecurityScanUseCase.test.ts

@@ -2,6 +2,7 @@ import { DailySecurityScanUseCase } from './DailySecurityScanUseCase';
 import { LocalCommandRunner } from './adapter-interfaces/LocalCommandRunner';
 import { IssueRepository } from './adapter-interfaces/IssueRepository';
 import { HttpRepository } from './adapter-interfaces/HttpRepository';
+import { KevReportWatermarkRepository } from './adapter-interfaces/KevReportWatermarkRepository';
 import { mock } from 'jest-mock-extended';
 
 const KEV_CATALOG_URL =
@@ -12,16 +13,21 @@ describe('DailySecurityScanUseCase', () => {
     const mockLocalCommandRunner = mock<LocalCommandRunner>();
     const mockIssueRepository = mock<IssueRepository>();
     const mockHttpRepository = mock<HttpRepository>();
+    const mockKevReportWatermarkRepository =
+      mock<KevReportWatermarkRepository>();
+    mockKevReportWatermarkRepository.load.mockResolvedValue({ type: 'absent' });
     const useCase = new DailySecurityScanUseCase(
       mockLocalCommandRunner,
       mockIssueRepository,
       mockHttpRepository,
+      mockKevReportWatermarkRepository,
     );
     return {
       useCase,
       mockLocalCommandRunner,
       mockIssueRepository,
       mockHttpRepository,
+      mockKevReportWatermarkRepository,
     };
   };
 
@@ -903,6 +909,210 @@ describe('DailySecurityScanUseCase', () => {
       errorSpy.mockRestore();
     });
 
+    it('logs an error and continues scanning remaining repositories when creating the findings issue fails', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => undefined);
+
+      mockIssueRepository.searchIssue.mockResolvedValue([]);
+      mockIssueRepository.createNewIssue.mockImplementation(
+        async (_org, repositoryName) => {
+          if (repositoryName === 'archived') {
+            throw new Error(
+              'Request failed with status code 403: Repository was archived so is read-only.',
+            );
+          }
+          return 1;
+        },
+      );
+
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find') {
+            return {
+              stdout:
+                '/repos/example-org/archived/.git\n/repos/example-org/app/.git\n',
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'mktemp') {
+            return {
+              stdout: `/tmp/${args[args.length - 1].replace('XXXXXX', 'abc123')}\n`,
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'git') {
+            const dir = args[1];
+            const repo = dir.split('/').pop() ?? '';
+            return {
+              stdout: `git@github.com:example-org/${repo}.git\n`,
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'osv-scanner') {
+            return {
+              stdout: JSON.stringify({
+                results: [
+                  {
+                    source: {
+                      path: args[args.indexOf('-r') + 1],
+                      type: 'lockfile',
+                    },
+                    packages: [
+                      {
+                        package: {
+                          name: 'example-library',
+                          version: '1.2.3',
+                          ecosystem: 'npm',
+                        },
+                        vulnerabilities: [
+                          {
+                            id: 'GHSA-1111-2222-3333',
+                            aliases: [],
+                            summary: 'Example Library Deserialization',
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                ],
+              }),
+              stderr: '',
+              exitCode: 1,
+            };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('archived'),
+      );
+      expect(
+        mockIssueRepository.createNewIssue.mock.calls.map((call) => call[1]),
+      ).toEqual(['archived', 'app']);
+      errorSpy.mockRestore();
+    });
+
+    it('logs an error and continues scanning remaining repositories when commenting on the existing findings issue fails', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => undefined);
+
+      mockIssueRepository.searchIssue.mockImplementation(
+        async ({ repositoryName }) =>
+          repositoryName === 'oversized'
+            ? [
+                {
+                  url: 'https://github.com/example-org/oversized/issues/1',
+                  title: 'Daily security scan findings',
+                  number: '1',
+                },
+              ]
+            : [],
+      );
+      mockIssueRepository.createCommentByUrl.mockRejectedValue(
+        new Error('Request failed with status code 422: Validation Failed'),
+      );
+
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find') {
+            return {
+              stdout:
+                '/repos/example-org/oversized/.git\n/repos/example-org/app/.git\n',
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'mktemp') {
+            return {
+              stdout: `/tmp/${args[args.length - 1].replace('XXXXXX', 'abc123')}\n`,
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'git') {
+            const dir = args[1];
+            const repo = dir.split('/').pop() ?? '';
+            return {
+              stdout: `git@github.com:example-org/${repo}.git\n`,
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'osv-scanner') {
+            return {
+              stdout: JSON.stringify({
+                results: [
+                  {
+                    source: {
+                      path: args[args.indexOf('-r') + 1],
+                      type: 'lockfile',
+                    },
+                    packages: [
+                      {
+                        package: {
+                          name: 'example-library',
+                          version: '1.2.3',
+                          ecosystem: 'npm',
+                        },
+                        vulnerabilities: [
+                          {
+                            id: 'GHSA-1111-2222-3333',
+                            aliases: [],
+                            summary: 'Example Library Deserialization',
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                ],
+              }),
+              stderr: '',
+              exitCode: 1,
+            };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('oversized'),
+      );
+      expect(
+        mockIssueRepository.createNewIssue.mock.calls.map((call) => call[1]),
+      ).toEqual(['app']);
+      errorSpy.mockRestore();
+    });
+
     it('adds a comment to the existing open issue for the repository instead of creating a new one', async () => {
       const { useCase, mockLocalCommandRunner, mockIssueRepository } =
         buildUseCase();
@@ -1105,6 +1315,53 @@ describe('DailySecurityScanUseCase', () => {
         },
       });
 
+    it('still reports KEV additions when the scanned repository findings issue cannot be written', async () => {
+      const { useCase, mockIssueRepository } = buildScanEnvironment(
+        osvScanOutput([
+          {
+            name: 'example-library',
+            version: '1.2.3',
+            ecosystem: 'npm',
+            id: 'GHSA-1111-2222-3333',
+            aliases: ['CVE-2024-0001'],
+            summary: 'Example Library Deserialization',
+          },
+        ]),
+        {
+          vulnerabilities: [
+            {
+              cveID: 'CVE-2024-0001',
+              vendorProject: 'Example',
+              product: 'Example Library',
+              vulnerabilityName: 'Example Library Deserialization',
+              dateAdded: '2024-01-02',
+            },
+          ],
+        },
+      );
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => undefined);
+      mockIssueRepository.createNewIssue.mockImplementation(
+        async (_org, repositoryName) => {
+          if (repositoryName === 'app') {
+            throw new Error(
+              'Request failed with status code 403: Repository was archived so is read-only.',
+            );
+          }
+          return 1;
+        },
+      );
+
+      await runWithKevReporting(useCase);
+
+      expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('app'));
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(1);
+      errorSpy.mockRestore();
+    });
+
     it('reports a KEV addition whose CVE the scanner found at an installed version', async () => {
       const { useCase, mockIssueRepository } = buildScanEnvironment(
         osvScanOutput([
@@ -1238,5 +1495,209 @@ describe('DailySecurityScanUseCase', () => {
       );
       expect(grepCalls).toHaveLength(0);
     });
+
+    const scannedExampleLibrary = osvScanOutput([
+      {
+        name: 'example-library',
+        version: '1.2.3',
+        ecosystem: 'npm',
+        id: 'GHSA-1111-2222-3333',
+        aliases: ['CVE-2024-0001', 'CVE-2024-0002', 'CVE-2024-0003'],
+        summary: 'Example Library Deserialization',
+      },
+    ]);
+
+    const kevCatalogOf = (
+      vulnerabilities: { cveID: string; dateAdded: string }[],
+    ) => ({
+      vulnerabilities: vulnerabilities.map((vulnerability) => ({
+        cveID: vulnerability.cveID,
+        vendorProject: 'Example',
+        product: 'ExampleLibrary',
+        vulnerabilityName: `${vulnerability.cveID} Deserialization`,
+        dateAdded: vulnerability.dateAdded,
+      })),
+    });
+
+    it('records every addition it considered in the watermark after the report issue is created', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([
+            { cveID: 'CVE-2024-0001', dateAdded: '2024-01-01' },
+            { cveID: 'CVE-2024-0002', dateAdded: '2024-01-02' },
+          ]),
+        );
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(1);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0002'],
+          },
+        ],
+      ]);
+    });
+
+    it('does not report an addition that the stored watermark already covers', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0001'],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+    });
+
+    it('reports an addition sharing the stored watermark date that was not reported before', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([
+            { cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' },
+            { cveID: 'CVE-2024-0002', dateAdded: '2024-01-02' },
+          ]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0001'],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      const kevCalls = kevReportCalls(
+        mockIssueRepository.createNewIssue.mock.calls,
+      );
+      expect(kevCalls).toHaveLength(1);
+      expect(kevCalls[0][3]).toContain('CVE-2024-0002');
+      expect(kevCalls[0][3]).not.toContain('CVE-2024-0001');
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: [
+              'CVE-2024-0001',
+              'CVE-2024-0002',
+            ],
+          },
+        ],
+      ]);
+    });
+
+    it('does not select an addition dated strictly before the stored watermark date', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-01' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: [],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+    });
+
+    it('advances the watermark over an addition that affects no scanned package so it is not weighed again', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-9999', dateAdded: '2024-01-02' }]),
+        );
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-9999'],
+          },
+        ],
+      ]);
+    });
+
+    it('skips the report and leaves the watermark untouched when the stored watermark is unreadable', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'unreadable',
+        reason: 'the stored watermark file holds malformed JSON',
+      });
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'the stored watermark file holds malformed JSON',
+        ),
+      );
+      errorSpy.mockRestore();
+    });
+
+    it('creates the report issue and logs when the watermark write fails, so the same additions are weighed again', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.save.mockRejectedValue(
+        new Error('disk is read-only'),
+      );
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(1);
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('disk is read-only'),
+      );
+      errorSpy.mockRestore();
+    });
   });
 });