test(tools): comprehensive test suite for track_vendor_response (+67 tests)

[manus-use]

Summary

Adds a comprehensive test suite for the track_vendor_response tool module — 67 fully-mocked tests covering all public functions and classification logic.

What's tested

Input validation (7 tests)

• Missing, empty, None, non-string, and invalid-prefix CVE IDs
• Lowercase CVE IDs accepted and uppercased

_fetch_nvd_references (6 tests)

• Successful fetch with references
• Empty vulnerabilities list, missing references key
• Network errors, HTTP errors, timeouts

_fetch_cisa_kev (5 tests)

• CVE found/not-found in KEV catalog
• Empty catalog, network failures
• Case-sensitive matching

_fetch_vulncheck_kev (7 tests)

• Successful fetch with data
• Empty data array, null data
• Missing/empty API key (no request made)
• Network failures
• Authorization header correctly sent

_classify logic (26 tests)

• All 6 states: patch_available, patch_pending, workaround_only, investigating, no_patch_expected, unknown
• NVD reference tag classification (Patch, Vendor-Advisory, Fix, Release-Notes, Mitigation, Workaround)
• URL keyword matching for patch/workaround detection
• CISA KEV requiredAction keyword promotion
• VulnCheck KEV unknown→investigating promotion
• Ransomware escalation (3 key variants)
• Combined multi-source confidence boosting
• Confidence bounds (never >1.0, always rounded to 3dp)
• Tag priority (Patch overrides Mitigation when both present)

End-to-end integration (16 tests)

• All sources empty → unknown
• Single-source triggers (NVD tags, CISA KEV, VulnCheck)
• Full Log4Shell simulation (all sources, max confidence)
• Result payload structure validation
• toolUseId preservation
• Signal counts and boolean flags

Duplicate check

Checked all open PRs (#51–#136) and merged PRs (#37–#102). No existing PR provides tests for track_vendor_response:

• PR feat(tools): vendor response tracker — track_vendor_response tool + manus-use vendor-response subcommand #58 and feat(cli): vendor-response subcommand + README Vulnerability Analysis Workflow #88 add CLI wiring for vendor-response but include zero tool-level tests
• PR test(core-tools): comprehensive test suite for check_cisa_kev, get_nvd_data, get_cwe_details, get_otx_cve_details #89 covers check_cisa_kev, get_nvd_data, get_cwe_details, get_otx_cve_details (different tools)
• PR test(tools): comprehensive test suite for search_exploit_db, search_packetstorm, query_threat_intelligence_feeds, obtain_cves #90 covers search_exploit_db, search_packetstorm, query_threat_intelligence_feeds, obtain_cves (different tools)
• PR test(tools): comprehensive test suite for submit_cves, tool_output_logger, and verify_exploit helpers #93 covers submit_cves, tool_output_logger, verify_exploit (different tools)

Test results

1225 passed, 3 deselected, 3 warnings (67 new tests)
ruff check: All checks passed
ruff format: clean