Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 39 additions & 5 deletions src/lib/ci.ts
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,11 @@ const IssueCountsBySeverityObject = z.object({

export type IssueCountsBySeverity = z.infer<typeof IssueCountsBySeverityObject>;

const ScanProgressObject = z.object({
completedEndpoints: z.number(),
totalEndpoints: z.number(),
});

const ScanStatusResponseObject = z.object({
scanId: z.string(),
label: z.string(),
Expand All @@ -101,6 +106,7 @@ const ScanStatusResponseObject = z.object({
issueCountsBySeverity: IssueCountsBySeverityObject.optional(),
reportReady: z.boolean(),
error: z.string().optional(),
progress: ScanProgressObject.optional(),
});

export type ScanStatus = z.infer<typeof ScanStatusResponseObject>;
Expand Down Expand Up @@ -212,10 +218,27 @@ export interface PollScanStatusParams {
onStatusUpdate?: (status: ScanStatus) => void;
}

function renderProgressBar(
label: string,
completed: number,
total: number,
barWidth = 30
): void {
const ratio = total > 0 ? completed / total : 0;
const percent = Math.round(ratio * 100);
const filled = Math.round(ratio * barWidth);
const empty = barWidth - filled;
const bar = "█".repeat(filled) + "░".repeat(empty);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Progress bar crashes when completed exceeds total endpoints

Medium Severity

If the server returns completedEndpoints > totalEndpoints (a plausible race condition or data inconsistency), filled exceeds barWidth, making empty negative. Calling "░".repeat(negative) throws a RangeError, crashing the entire polling loop. Clamping filled to [0, barWidth] would prevent this.

Fix in Cursor Fix in Web

const line = ` ${label} ${bar} ${percent}% (${completed}/${total} endpoints)`;

process.stdout.write(`\r${line}`);
}

export async function pollScanStatus(
params: PollScanStatusParams
): Promise<ScanStatus> {
const pollIntervalMs = params.pollIntervalMs ?? 5000;
let progressShown = false;

const sleep = (ms: number): Promise<void> =>
new Promise((resolve) => setTimeout(resolve, ms));
Expand All @@ -229,23 +252,34 @@ export async function pollScanStatus(

params.onStatusUpdate?.(status);

if (status.progress && status.progress.totalEndpoints > 0) {
renderProgressBar(
status.label,
status.progress.completedEndpoints,
status.progress.totalEndpoints
);
progressShown = true;
} else if (!progressShown) {
process.stdout.write(
`\r ${status.label} status: ${status.status}...`
);
}

if (status.status === "failed") {
if (progressShown) process.stdout.write("\n");
throw new Error(`Pentest failed: ${status.errorMessage}`);
}

if (status.status === "completed") {
if (progressShown) process.stdout.write("\n");
return status;
}

if (status.status === "paused") {
if (progressShown) process.stdout.write("\n");
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing newline when fallback status line was written

Medium Severity

When the scan completes without ever receiving progress data (e.g., goes directly from queued to completed), the fallback status line is written via process.stdout.write with \r but no trailing newline. Since progressShown stays false, no \n is emitted before returning or throwing. The caller (runScan) then calls console.log, which appends to the same line, producing garbled output like my-scan status: completed...Pentest my-scan completed with 0 issues.

Additional Locations (1)
Fix in Cursor Fix in Web

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No terminal cleanup when getScanStatus throws mid-polling

Low Severity

If getScanStatus throws on a subsequent loop iteration (e.g., network timeout, HTTP 500), the exception propagates out of pollScanStatus without writing a newline. The previous process.stdout.write with \r left the cursor at the end of a partial line (either the progress bar or the fallback status). The caller's error output then renders on that same line, producing garbled terminal output. A try/finally around the loop body that emits \n when output has been written would handle this.

Fix in Cursor Fix in Web

throw new Error("Pentest was paused");
}

console.log(
`Pentest ${status.label} status: ${status.status}. Polling again in ${
pollIntervalMs / 1000
}s...`
);
await sleep(pollIntervalMs);
}
}
Expand Down
Loading