test(tools): comprehensive test suite for check_cisa_kev module (+43 tests)

[manus-use]

Summary

Comprehensive test suite for the check_cisa_kev tool module — 43 fully-mocked tests covering:

Coverage areas

• TOOL_SPEC validation — schema structure, required fields, type definitions
• _get_kev_data caching logic — fresh cache hit, stale cache refetch, missing cache, network errors (ConnectionError, Timeout), cache write verification, missing timestamp handling, malformed cache file behaviour
• check_cisa_kev main function — CVE found (exploit confirmed), CVE not found, case-insensitive matching, exact match (no partial), multiple CVEs in catalog, empty catalog, missing vulnerabilities key, empty/None/integer input validation, tool_use_id propagation
• log_tool_output_size integration — called on every exit path (found, not found, invalid input, data retrieval error)
• Edge cases — single-entry catalog, mixed-case catalog entries, missing input key, content structure validation
• Module constants — CACHE_DURATION value, CACHE_FILE path validation

Discovered issue

The test suite documents a known limitation: _get_kev_data() does not wrap json.loads() in a try/except when reading the cache file. A corrupted .cisa_kev_cache.json will propagate a JSONDecodeError rather than falling through to a fresh API fetch. This is documented as test_malformed_cache_file_raises_json_error.

Test results

1201 passed, 3 deselected, 3 warnings in 24.44s

Baseline: 1158 tests + 43 new = 1201 total, 0 failures.

Open PRs checked (no overlap)

Reviewed all 50 open PRs (#115–#164). The closest is #122 (feat(cli): add check-kev subcommand) which adds a CLI subcommand — this PR adds unit tests for the underlying tool module (check_cisa_kev), which is a completely different concern. No existing open or merged PR provides test coverage for the check_cisa_kev tool function or its _get_kev_data caching helper.