feat: Refactor scanner functionality and improve error handling

Author: sdmdg

workspaces/ballerina/ballerina-extension/src/features/ai/agent/tool-registry.ts

@@ -56,6 +56,7 @@ import { createHurlTool, HURL_TOOL_NAME } from './tools/hurl-tool';
 import { createWebSearchTool, WEB_SEARCH_TOOL_NAME, createWebFetchTool, WEB_FETCH_TOOL_NAME } from './tools/web-tools';
 import { createClarifyTool, CLARIFY_TOOL } from './tools/clarify';
 import { createSecurityTool, SECURITY_TOOL_NAME } from './tools/security-diagnostics';
+import { isScannerConfigEnabled } from '../../scanner/scan-utils';
 
 export interface ToolRegistryOptions {
     eventHandler: CopilotEventHandler;
@@ -124,11 +125,14 @@ export function createToolRegistry(opts: ToolRegistryOptions) {
         [FILE_READ_TOOL_NAME]: createReadTool(
             createReadExecute(eventHandler, tempProjectPath)
         ),
-        [SECURITY_TOOL_NAME]: createSecurityTool(tempProjectPath, eventHandler, {
-            workspacePath: projectRootPath,
-            projectPath: ctx.projectPath,
-            modifiedFiles,
-        }),
+        // Security tool — registered only when the scanner configuration is explicitly enabled
+        ...(isScannerConfigEnabled() ? {
+            [SECURITY_TOOL_NAME]: createSecurityTool(tempProjectPath, eventHandler, {
+                workspacePath: projectRootPath,
+                projectPath: ctx.projectPath,
+                modifiedFiles,
+            })
+        } : {}),
         [DIAGNOSTICS_TOOL_NAME]: createDiagnosticsTool(tempProjectPath, eventHandler),
         [TEST_RUNNER_TOOL_NAME]: createTestRunnerTool(tempProjectPath, eventHandler, modifiedFiles, allModifiedFiles, ctx),
         // Migration source tools — registered only when a source project path is available

workspaces/ballerina/ballerina-extension/src/features/scanner/activator.ts

@@ -17,7 +17,7 @@
  */
 
 import * as vscode from 'vscode';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { BallerinaExtension } from 'src/core';
 import { scannerContentChanged } from '@wso2/ballerina-core';
 import { isScannerConfigEnabled, isScannerVersionSupported, setScannerVersionSupported, isScannerActive, getScannerOutputChannel, setScannerState, pullOrUpdateScannerTool } from './scan-utils';
@@ -30,8 +30,13 @@ import { RPCLayer } from '../../RPCLayer';
  * Checks if the scan tool version is greater than 0.11.0.
  */
 function checkScanToolVersion(callback: (state: ScannerToolState) => void) {
-    exec('bal tool list', (error, stdout) => {
+    execFile('bal', ['tool', 'list'], { timeout: 15000 }, (error, stdout) => {
         if (error) {
+            if (error.killed || (error as any).code === 'ETIMEDOUT') {
+                console.warn('[Scanner] bal tool list timed out');
+                callback('NOT_FOUND');
+                return;
+            }
             callback('NOT_FOUND');
             return;
         }
@@ -107,6 +112,12 @@ function resolveProjectRoot(uri?: vscode.Uri): vscode.Uri | undefined {
  * Activates the Ballerina Security Scanner feature.
  */
 export function activate(ballerinaExtInstance: BallerinaExtension): void {
+    const langClient = ballerinaExtInstance.langClient;
+    if (!langClient) {
+        vscode.window.showErrorMessage("Ballerina Language Server is not ready. Scanner disabled.");
+        return;
+    }
+
     let scannerContentChangedDebounce: NodeJS.Timeout | undefined;
     const scannerRpcManager = new ScannerRpcManager();
 
@@ -161,11 +172,7 @@ export function activate(ballerinaExtInstance: BallerinaExtension): void {
         await pullOrUpdateScannerTool();
     });
 
-    const langClient = ballerinaExtInstance.langClient;
-    if (!langClient) {
-        vscode.window.showErrorMessage("Ballerina Language Server is not ready. Scanner disabled.");
-        return;
-    }
+
 
     // Register Scan Command — delegates to the RPC manager (no direct LS calls here)
     const scanDisposable = vscode.commands.registerCommand('ballerina.scan.project', async (uri?: vscode.Uri) => {
@@ -188,7 +195,7 @@ export function activate(ballerinaExtInstance: BallerinaExtension): void {
             return;
         }
 
-        if (!isScannerVersionSupported) {
+        if (!isScannerVersionSupported()) {
             vscode.window.showErrorMessage("Ballerina Security Scanner requires the 'scan' tool version > 0.11.0. Please update your tool.");
             return;
         }
@@ -197,7 +204,15 @@ export function activate(ballerinaExtInstance: BallerinaExtension): void {
         outputChannel.appendLine(`[INFO] [SCAN] Start: ${projectRootUri.fsPath}`);
 
         // Delegate to the RPC manager — the single source of truth for LS calls
-        const result = await scannerRpcManager.scanProject({ projectPath: projectRootUri.fsPath });
+        let result;
+        try {
+            result = await scannerRpcManager.scanProject({ projectPath: projectRootUri.fsPath });
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            outputChannel.appendLine(`[ERROR] [SCAN] Failed: ${message}`);
+            vscode.window.showErrorMessage(`Security Scan Failed: ${message}`);
+            return;
+        }
 
         const scanError = result.errorMsg || result.error;
         if (scanError) {

workspaces/ballerina/ballerina-extension/src/features/scanner/scan-utils.ts

@@ -30,7 +30,10 @@ export type ScannerToolState = 'NOT_FOUND' | 'INCOMPATIBLE' | 'SUPPORTED';
 /**
  * Tracks whether the scanner tool version is supported in the current workspace.
  */
-export let isScannerVersionSupported = false;
+let _isScannerVersionSupported = false;
+export function isScannerVersionSupported(): boolean {
+    return _isScannerVersionSupported;
+}
 
 export const DEFAULT_SCAN_TIMEOUT_MS = 120000;
 
@@ -61,13 +64,16 @@ function runBalToolCommand(command: string): Promise<void> {
 }
 
 export function setScannerVersionSupported(supported: boolean) {
-    isScannerVersionSupported = supported;
+    _isScannerVersionSupported = supported;
 }
 
-export let scannerState: ScannerToolState = 'NOT_FOUND';
+let _scannerState: ScannerToolState = 'NOT_FOUND';
+export function scannerState(): ScannerToolState {
+    return _scannerState;
+}
 
 export function setScannerState(state: ScannerToolState) {
-    scannerState = state;
+    _scannerState = state;
 }
 
 export function isScannerConfigEnabled(): boolean {
@@ -78,12 +84,12 @@ export function isScannerConfigEnabled(): boolean {
 }
 
 export function isScannerActive(): boolean {
-    return isScannerConfigEnabled() && isScannerVersionSupported;
+    return isScannerConfigEnabled() && isScannerVersionSupported();
 }
 
 export async function pullOrUpdateScannerTool(): Promise<boolean> {
     const outputChannel = getScannerOutputChannel();
-    const isNotInstalled = scannerState === 'NOT_FOUND';
+    const isNotInstalled = scannerState() === 'NOT_FOUND';
     const command = isNotInstalled ? 'bal tool pull scan' : 'bal tool update scan';
     const actionLabel = isNotInstalled ? 'Pulling' : 'Updating';
     const completionLabel = isNotInstalled ? 'pulled' : 'updated';

workspaces/ballerina/ballerina-extension/src/features/scanner/security-rules.ts

@@ -81,7 +81,7 @@ const HINT_BY_RULE_ID = new Map<string, string>(
  * Returns the security severity for a given rule ID.
  */
 export function getRuleSeverity(ruleId: string): ScannerRuleSeverity {
-    return SEVERITY_BY_RULE_ID.get(ruleId);
+    return SEVERITY_BY_RULE_ID.get(ruleId) ?? 'MEDIUM';
 }
 
 /**

workspaces/ballerina/ballerina-extension/src/rpc-managers/scanner/rpc-manager.ts

@@ -313,7 +313,7 @@ export class ScannerRpcManager implements ScannerAPI {
             const documentUri = this.resolveDocumentUri(params as DisableRuleRequest & { filePath?: string });
             if (!documentUri) {
                 vscode.window.showErrorMessage("No document found to resolve project root for global exclusion.");
-                return;
+                return false;
             }
 
             const response = await withTimeout(
@@ -494,7 +494,7 @@ export class ScannerRpcManager implements ScannerAPI {
         if (!isScannerConfigEnabled()) {
             return { success: false, activeIssues: [], excludedIssues: [], errorMsg: "Scanner is disabled via settings." };
         }
-        if (!isScannerVersionSupported) {
+        if (!isScannerVersionSupported()) {
             const errorMsg = "Ballerina Security Scanner requires the 'scan' tool version > 0.11.0. Please update your tool by running 'bal tool pull scan'.";
             vscode.window.showErrorMessage(errorMsg);
             return { success: false, activeIssues: [], excludedIssues: [], errorMsg };

workspaces/ballerina/ballerina-extension/src/views/scanner/webview.ts

@@ -70,8 +70,8 @@ export class ScannerWebview {
 
     private getWebviewContent(webView: vscode.Webview): string {
         const scannerEnabled = isScannerConfigEnabled();
-        const scannerVersionSupported = isScannerVersionSupported;
-        const currentScannerState = scannerState;
+        const scannerVersionSupported = isScannerVersionSupported();
+        const currentScannerState = scannerState();
         const activeEditorUri = vscode.window.activeTextEditor?.document.uri;
         const activeWorkspaceFolder = activeEditorUri ? vscode.workspace.getWorkspaceFolder(activeEditorUri) : undefined;
         const fallbackWorkspaceFolder = vscode.workspace.workspaceFolders?.[0];
@@ -120,13 +120,22 @@ export class ScannerWebview {
                 100%  {transform:scaleY(-1) rotate(-135deg)}
             }
         `;
+        const safeCurrentScannerState = JSON.stringify(currentScannerState)
+            .replace(/</g, '\\u003c')
+            .replace(/\u2028/g, '\\u2028')
+            .replace(/\u2029/g, '\\u2029');
+        const safeProjectPath = JSON.stringify(projectPath)
+            .replace(/</g, '\\u003c')
+            .replace(/\u2028/g, '\\u2028')
+            .replace(/\u2029/g, '\\u2029');
+
         const scripts = `
             function loadedScript() {
                 function renderDiagrams() {
                     window.__SCANNER_ENABLED__ = ${scannerEnabled};
                     window.__SCANNER_VERSION_SUPPORTED__ = ${scannerVersionSupported};
-                    window.__SCANNER_STATE__ = ${JSON.stringify(currentScannerState)};
-                    window.__SCANNER_PROJECT_PATH__ = ${JSON.stringify(projectPath)};
+                    window.__SCANNER_STATE__ = ${safeCurrentScannerState};
+                    window.__SCANNER_PROJECT_PATH__ = ${safeProjectPath};
                     window.__SCANNER_DEPLOY_MODE__ = ${this._mode === 'deploy'};
                     visualizerWebview.renderWebview("scanner", document.getElementById("webview-container"));
                 }

workspaces/ballerina/ballerina-visualizer/src/views/AIPanel/components/AgentStreamView/StreamEntry.tsx

@@ -156,8 +156,8 @@ function getToolResultDisplay(toolName: string | undefined, toolOutput: any, hin
             return { label: count > 0 ? `Found ${count} error(s)` : "No issues found" };
         }
         case "getSecurityVulnerabilities": {
-            if (toolOutput?.success === false && toolOutput?.message) {
-                return { label: toolOutput.message };
+            if (toolOutput?.success === false) {
+                return { label: toolOutput?.message || "Security scan failed" };
             }
             const count = toolOutput?.count ?? 0;
             return { label: count > 0 ? `Found ${count} security issue(s)` : "No security issues found" };