diff --git a/sdk/typescript/src/cli.ts b/sdk/typescript/src/cli.ts index c4e332b7..47462f54 100644 --- a/sdk/typescript/src/cli.ts +++ b/sdk/typescript/src/cli.ts @@ -1216,13 +1216,13 @@ export async function main( args: readonly string[], select: (value: JsonObject) => JsonObject | Promise = (value) => value, - ): Promise => { + ): Promise => { try { return await select(await dependencies.runWorkbench(args)); } catch (error) { errorOutput.write(`codex-security: ${errorMessage(error)}\n`); exitCode = 2; - return undefined; + throw error; } }; const latestScans = async ( @@ -1613,7 +1613,7 @@ export async function main( } catch (error) { errorOutput.write(`codex-security: ${errorMessage(error)}\n`); exitCode = 2; - return undefined; + throw error; } }, }) diff --git a/sdk/typescript/tests-ts/cli.test.ts b/sdk/typescript/tests-ts/cli.test.ts index 6c297b62..fcf5fd2e 100644 --- a/sdk/typescript/tests-ts/cli.test.ts +++ b/sdk/typescript/tests-ts/cli.test.ts @@ -1220,6 +1220,32 @@ describe("CLI", () => { ); }); + test("does not emit an ok: true envelope for a failed structured history command", async () => { + for (const argv of [ + ["scans", "show", "--json"], + ["scans", "list", "--json"], + ["scans", "compare", "before", "after", "--json"], + ["scans", "match", "before", "after", "--json"], + ]) { + const stdout = capture(); + const stderr = capture(); + const result = await main(argv, stdout.stream, stderr.stream, { + ...dependencies({ + onWorkbench: () => { + throw new Error( + "Scan ID prefixes must be at least eight characters.", + ); + }, + }), + }); + expect(result).toBe(2); + expect(stdout.text()).toBe(""); + expect(stderr.text()).toContain( + "Scan ID prefixes must be at least eight characters.", + ); + } + }); + test("shows finding history and optionally reveals linked findings", async () => { const findings: JsonObject[] = [ {