[containarium-ci]

For #32: Web: SBOM/VEX inputs on the scan form (follow-up to S5)

Closes #32

The line above closes the issue when this pull request is merged. The reviewer can edit or delete that line before merging.

What and why

The platform made the commits and the branch from the files the agent handed back; it does not use the agent's own git state on the box, so anything the summary says about committing, branching or pushing describes only what the agent could do there.

The agent's summary, quoted:

The scan form already had the SBOM/VEX URL and file-upload inputs, and the report view already
groups components by confidence and shows SBOM_SUPPLIED evidence. This change adds what was missing:
a paste box for the SBOM/VEX document (sent as sbom_document), a 2 MiB cap enforced in the form
before any request (for pasted text and uploaded files, with an alert), component tests for pasted
input and both oversize cases, and README text for the web inputs. Not committed and tests not run:
git and the JS toolchain were unavailable in the sandbox.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. Most of the issue was already in the repo: the SBOM/VEX URL and file inputs, the request builder
   mapping, and the confidence and evidence display. I added only the paste box, the size cap, tests
   and docs.
2. Pasted text is used instead of a chosen file when both are given. The issue did not say which
   should win, and a single sbom_document field can carry only one.
3. The 2 MiB cap is checked in the browser on the UTF-8 byte length of pasted text and on File.size
   for uploads, before reading the file. The limit is exactly 2<<20 bytes, matching the service cap.
4. Not committed: every git command needed approval, which this non-interactive session cannot give.
   The changes are uncommitted in the clone, and agent/issue-32 was not created.
5. Tests were not run because web/node_modules is not installed and the Bash tool required approval
   for the command. The edited tests are unverified.

Changes

• web/src/components/scan-form.tsx — 169 lines
• web/src/components/scan-page.test.tsx — 166 lines
• README.md — 81 lines

3 file(s) in all.

Checks

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it. CI results appear on this pull request.

• Started from commit a8c867f87ce82068313df6d60f523ba8d09cbc37, as reported by the agent
• Tool access in force for this run: build_tools
• Tests, as reported by the agent: not_run

How this pull request was made

Opened by the platform from a coding agent's run on a member's box (run e28175f5). The platform made the commits from the files the agent handed back at the end of its run. Nothing is merged automatically.

[hsinatfootprintai]

Review (comment only; this account authored the PR)

Verdict: request changes: the web check is red.
Tests run locally: not re-run; CI: go, e2e, proto SUCCESS, web FAILURE. PR MERGEABLE. Small diff: README +5, scan-form.tsx +38, scan-page.test.tsx +34.
Failing test: ScanPage > sends pasted SBOM/VEX text as sbomDocument (web/src/components/scan-page.test.tsx) fails with TestingLibraryElementError: Unable to find role="region" and name "Low confidence". The new test submits a scan and then looks for a result region that never appears, which suggests the mocked response or the form submit path in the test does not produce a report. It is a test (or test setup) problem until shown otherwise: confirm the real form submits pasted text correctly.
Acceptance (from #32's title and the PR): pasted SBOM/VEX input and a 2 MiB cap on the scan form. Code is present; the only test for the pasted-text path is the failing one, so the behavior is unproven. I did not verify the 2 MiB cap has a test.
Docs impact: README +5, covers the new input.

Blocking

• Fix scan-page.test.tsx so it passes in CI (and keep a test that the pasted text reaches sbomDocument). A revise run (@containarium changes <text>) can do this: it fixed the same kind of failure on #47.

Should fix

• Add a test for the 2 MiB cap (reject over the limit with a message).

[hsinatfootprintai]

@containarium changes Fix the failing web check only: web/src/components/scan-page.test.tsx 'sends pasted SBOM/VEX text as sbomDocument' fails with 'Unable to find role=region and name Low confidence'. Make the test submit the form and receive its mocked report so the region renders (or assert on what the pasted-text path actually sends), keep the assertion that the pasted text reaches sbomDocument, and add a test that over 2 MiB of pasted text is rejected with a message. Change nothing else.

[containarium-ci]

The agent will revise pull request #56 using that feedback. It starts from the pull request's branch and updates the same pull request when it is done; nothing is merged automatically.

Next: reply @containarium status to see the run, or @containarium stop to cancel it.

[hsinatfootprintai]

@containarium status

[containarium-ci]

Pull request #56 was opened by the agent for #32; this is that issue's latest run.

The last run for this issue (run 65442337, a revision of pull request #56) finished at 2026-10-31T13:51:24Z and ended without a change because the agent's run on the box failed.

Next: reply @containarium start to start a run.

[hsinatfootprintai]

@containarium changes Fix the failing web check only: web/src/components/scan-page.test.tsx 'sends pasted SBOM/VEX text as sbomDocument' fails with 'Unable to find role=region and name Low confidence'. Make the test submit the form and receive its mocked report so the region renders (or assert on what the pasted-text path actually sends), keep the assertion that the pasted text reaches sbomDocument, and add a test that over 2 MiB of pasted text is rejected with a message. Change nothing else.

[containarium-ci]

The agent will revise pull request #56 using that feedback. It starts from the pull request's branch and updates the same pull request when it is done; nothing is merged automatically.

Next: reply @containarium status to see the run, or @containarium stop to cancel it.

[containarium-ci]

No change was proposed for this issue because the agent's run on the box failed. Nothing was pushed.

Next: reply @containarium status to see where this is, or @containarium start to try again.

— run 65459468

[hsinatfootprintai]

@containarium changes Fix the failing web check only: web/src/components/scan-page.test.tsx 'sends pasted SBOM/VEX text as sbomDocument' fails with 'Unable to find role=region and name Low confidence'. Make the test submit the form and receive its mocked report so the region renders (or assert on what the pasted-text path actually sends), keep the assertion that the pasted text reaches sbomDocument, and add a test that over 2 MiB of pasted text is rejected with a message. Change nothing else.

[containarium-ci]

Pull request #56 has already been revised 2 times, which is the most the agent does on one pull request.

Next: make the remaining changes by hand, or close it and reply @containarium start on the issue.

[hsinatfootprintai]

Closing: the revise budget was used up by runs the platform refused before the agent started (cloud#3665). Re-running #32 from current main.