NEW @W-21910054@ Message sanitization

[nikhil-mittal-165]

Summary

Sanitizes user-facing ApexGuru notifications so that raw backend/exception text is never interpolated directly into a UI banner. Raw detail is now routed to logger.log() (visible via the "Details" button → log output) while the banner itself shows static, canned copy.

• NO_ORG_CONNECTION / API_UNAVAILABLE: switched from messages.insights.apexGuruSkipped.xxx(message) (raw text) to static message constants; raw message/remediation now goes to the logger only.
• Added INVALID_SESSION and SCAN_TIMEOUT handling, wired to the corresponding error codes emitted by code-analyzer-apexguru-engine's engine.ts (isInvalidSessionError / isScanTimeoutError).
  • INVALID_SESSION is shown once per session (persistent condition, mirrors the existing NO_ORG_CONNECTION suppression).
  • SCAN_TIMEOUT always shows (transient, matches API_UNAVAILABLE's behavior).

Test plan

• Added/updated unit tests in insights-handler.test.ts covering the new banners, once-vs-always suppression semantics, and button callbacks.
• npm run test:unit — all tests pass.
• npm run lint and typecheck pass.

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[aruntyagiTutu]

Nice fix — the core problem this solves is real: apiUnavailable/noOrgConnection previously interpolated raw exception/remediation text directly into a user-facing notification (apexGuruSkipped.apiUnavailable(message)). Since that text can originate from the backend/exception rather than a fixed set of known strings, displaying it verbatim in the UI is exactly the kind of thing "sanitization" should prevent. Replacing it with static, canned copy and routing the raw detail to logger.log() instead (visible via "Details" → log output) is the right shape. The new INVALID_SESSION/SCAN_TIMEOUT handlers correctly wire up the corresponding codes that code-analyzer-apexguru-engine's engine.ts (isInvalidSessionError/isScanTimeoutError) already emits, and the once-per-session suppression for INVALID_SESSION mirrors the existing NO_ORG_CONNECTION pattern appropriately (persistent condition) while SCAN_TIMEOUT correctly always shows (transient, matches API_UNAVAILABLE's behavior). Tests are thorough — cover the new banners, the once-vs-always suppression semantics, and the button callbacks.

One thing I'd like called out explicitly since the PR description is empty: this diff also silently removes the "Default target-org set to '{orgAlias}'. Re-run the scan to use ApexGuru." confirmation banner (orgSetSuccess) after a user picks an org from the QuickPick — that path now only logs internally, with zero user-facing feedback on success. Unlike the other changes here, orgAlias isn't attacker/backend-controlled text, so this doesn't look like it's motivated by the sanitization goal — it reads more like an unrelated UX regression that got swept in. Was dropping that toast intentional? If so, worth a line in the PR description; if not, it should probably be restored.

Minor/non-blocking: finishedScan's casing changed from "Scan complete" to "Scan Complete" — inconsistent with the sentence-case style used elsewhere in this same file (e.g. "ApexGuru analysis was skipped...").

[nikhil-mittal-165]

Thanks for the thorough review, @aruntyagiTutu!

Both callouts were right — the orgSetSuccess toast removal and the finishedScan casing change were unintentional side-effects, not motivated by the sanitization goal. Fixed in 34abe5e:

• Restored the orgSetSuccess confirmation banner after a user picks an org from the QuickPick (kept the existing logger.log alongside it). Added a test assertion (insights-handler.test.ts) so this doesn't silently regress again.
• Reverted finishedScan back to sentence case ("Scan complete.") to match the rest of the file, and fixed the two test assertions that had been flipped to the wrong casing along with it.

Also filled in the PR description with a summary of the sanitization change, since it was empty. All 373 unit tests + lint + typecheck pass locally.

[aruntyagiTutu]

Thanks for addressing both points — the orgSetSuccess confirmation banner is restored (with a test asserting it's shown after setting target-org), and the "Scan Complete"/"Scan complete" casing is back to matching the rest of the file. LGTM.