test(cli): comprehensive test suite for manus-agent blast-radius subcommand (+45 tests)

[manus-use]

Summary

Comprehensive test suite for the _run_blast_radius CLI execution function — 45 fully-mocked tests covering all internal execution paths.

What's tested

Parser (_build_blast_radius_parser)

• Positional spec argument acceptance (CVE IDs, package specs, ecosystem-qualified)
• --output flag (text/json default/override, invalid rejection)
• --max-packages flag (default 10, custom values)
• Missing required arguments rejected

Input validation

• Import error returns exit code 1 with stderr message
• _parse_input ValueError returns exit code 1

CVE mode (multi-source fetching + deduplication)

• NVD + OSV + GHSA results merged and deduplicated
• Case-insensitive deduplication (name + ecosystem)
• OSV takes precedence over NVD in dedup (ordered merge)
• --max-packages truncates the enrichment list
• Empty results from all sources returns exit code 1
• GHSA-exclusive packages included in output

Direct package mode

• Bare package name (no version → version_range: "all")
• Ecosystem-qualified spec (npm:axios@1.6.0)
• No CVE fetch functions called in direct mode

Severity sorting

• Packages sorted CRITICAL > HIGH > MEDIUM > LOW > UNKNOWN
• UNKNOWN severity sorts last

JSON output format

• Required top-level keys: spec, cve_id, packages, summary
• Summary calculations: total_weekly_downloads, total_dependent_packages
• cve_id populated in CVE mode, null in package mode
• None weekly_downloads excluded from sum

Text output format

• Header with title and separator
• Per-package fields: blast radius, vulnerable range, npm dependents, downloads, latest version, Maven artifact, description
• Description truncated to 80 chars
• Missing optional fields suppressed
• Summary line with highest severity and totals
• Zero totals suppress summary download/dep lines

Enrichment orchestration

• _enrich_package called with correct (name, ecosystem) args
• _blast_score receives enriched dict with version_range + source injected

Subcommand dispatch

• main() correctly routes blast-radius to _run_blast_radius

Test methodology

• 100% mocked — no real HTTP calls
• Tests patch at manus_agent.tools.get_dependency_blast_radius.* level (where _run_blast_radius imports from)
• Each test uses separate dict instances to avoid mutation bugs from shared mock return values

Open PRs checked (no overlap)

Reviewed all 50 open PRs (#113–#162). PR #121 (test/cli-subcommand-tests) covers blast-radius subcommand dispatch only (argparse registry + basic stub), NOT the _run_blast_radius execution logic tested here.

Test results

1203 passed, 3 deselected, 3 warnings in 25s

Baseline: 1158 → 1203 (+45 new tests, 0 failures)