Cursor/pr193 consolidate fixes

[DevOpsMadDog]

Summary by cubic

Consolidates fixes from PRs #191 and #192 to resolve PR #185 issues, strengthen SBOM CLI/normalizer error handling, and fix CI failures. Also cleans up imports and minor syntax across agents, API, and risk modules, and adds analysis docs.

• Bug Fixes

  • SBOM CLI: add robust try/except, clear messages, non-zero exits on failures.
  • Normalizer: better file/JSON errors and validation messages.
  • CI: format failing test fixtures; add .coverage to .gitignore and remove tracked file.
  • Agents/API: fix import order/syntax (e.g., agent_framework), tidy HTTP errors and responses in Pentagi routes.
  • Minor fixes across enterprise services (crypto, decision engine) and tests to unblock formatting checks.

• Refactors

  • Consistent import ordering and small cleanups across agents, risk, runtime, and compliance modules.
  • Minor readability tweaks (logging, line wraps, async tasks, exponential backoff).
  • Add analysis docs (CI fixes, PR185 fixes summary, model comparison, pre-merge status).

^{Written for commit 62518b2. Summary will update automatically on new commits.}

[cubic-dev-ai]

2 issues found across 108 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all 2 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="cli/fixops_sbom.py">

<violation number="1" location="cli/fixops_sbom.py:116">
P2: Misleading error message: after the `path.exists()` check succeeds, any `FileNotFoundError` here cannot be from `normalized_path` - it would come from `build_and_write_quality_outputs()` (e.g., output directory issues). Consider capturing the exception with `as e` and using a generic message.</violation>
</file>

<file name="risk/reachability/code_analysis.py">

<violation number="1" location="risk/reachability/code_analysis.py:427">
P1: Dict comprehension overwrites the &#39;pattern&#39; key on each iteration, keeping only the last function. This should be a list comprehension to generate multiple pattern dictionaries for `pattern-either`.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

P2: Misleading error message: after the path.exists() check succeeds, any FileNotFoundError here cannot be from normalized_path - it would come from build_and_write_quality_outputs() (e.g., output directory issues). Consider capturing the exception with as e and using a generic message.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cli/fixops_sbom.py, line 116:

<comment>Misleading error message: after the `path.exists()` check succeeds, any `FileNotFoundError` here cannot be from `normalized_path` - it would come from `build_and_write_quality_outputs()` (e.g., output directory issues). Consider capturing the exception with `as e` and using a generic message.</comment>

<file context>
@@ -72,20 +73,57 @@ def build_parser() -&gt; argparse.ArgumentParser:
+        build_and_write_quality_outputs(normalized, json_path, html_path)
+        print(f&quot;Wrote quality report to {json_path} and HTML to {html_path}&quot;)
+        return 0
+    except FileNotFoundError:
+        print(f&quot;Error: File not found: {normalized_path}&quot;, file=sys.stderr)
+        return 1
</file context>

Suggested change

	except FileNotFoundError:
	print(f"Error: File not found: {normalized_path}", file=sys.stderr)
	except FileNotFoundError as e:
	print(f"Error: File not found: {e}", file=sys.stderr)

[cubic-dev-ai]

P1: Dict comprehension overwrites the 'pattern' key on each iteration, keeping only the last function. This should be a list comprehension to generate multiple pattern dictionaries for pattern-either.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At risk/reachability/code_analysis.py, line 427:

<comment>Dict comprehension overwrites the &#39;pattern&#39; key on each iteration, keeping only the last function. This should be a list comprehension to generate multiple pattern dictionaries for `pattern-either`.</comment>

<file context>
@@ -416,7 +424,10 @@ def _build_semgrep_rules(
                         {
                             &quot;pattern-either&quot;: [
-                                {&quot;pattern&quot;: f&quot;$X({func})&quot; for func in pattern.vulnerable_functions}
+                                {
+                                    &quot;pattern&quot;: f&quot;$X({func})&quot;
+                                    for func in pattern.vulnerable_functions
</file context>