From 4eb257869712ea59684cdd44c998d4a76d7aca5a Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Thu, 29 Jan 2026 19:51:53 +0530
Subject: [PATCH 01/17] Add macOS Docker and Podman fallback paths; enhance
 engine path resolution

---
 .../realtimeengine/iacrealtime/constants.go   |  19 +++
 .../iacrealtime/container-manager.go          | 118 +++++++++++++++++-
 .../iacrealtime/iac-realtime.go               |  87 +++++++++++--
 3 files changed, 212 insertions(+), 12 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/constants.go b/internal/services/realtimeengine/iacrealtime/constants.go
index 5d8c1f449..2880d7a69 100644
--- a/internal/services/realtimeengine/iacrealtime/constants.go
+++ b/internal/services/realtimeengine/iacrealtime/constants.go
@@ -10,6 +10,25 @@ const (
 	IacEnginePath            = "/usr/local/bin"
 )
 
+// macOSDockerFallbackPaths contains additional paths to check for Docker on macOS
+// These paths cover various Docker installation methods:
+// - /usr/local/bin/docker: Standard location (Intel Macs)
+// - /opt/homebrew/bin/docker: Homebrew on Apple Silicon
+// - /Applications/Docker.app/Contents/Resources/bin/docker: Docker Desktop app bundle
+// - ~/.docker/bin/docker: Docker Desktop CLI tools (resolved at runtime)
+// - ~/.rd/bin/docker: Rancher Desktop (resolved at runtime)
+var macOSDockerFallbackPaths = []string{
+	"/usr/local/bin",
+	"/opt/homebrew/bin",
+	"/Applications/Docker.app/Contents/Resources/bin",
+}
+
+// macOSPodmanFallbackPaths contains additional paths to check for Podman on macOS
+var macOSPodmanFallbackPaths = []string{
+	"/usr/local/bin",
+	"/opt/homebrew/bin",
+}
+
 var KicsErrorCodes = []string{"60", "50", "40", "30", "20"}
 
 type LineIndex struct {
diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index f42b8c870..917fcd581 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -1,11 +1,17 @@
 package iacrealtime
 
 import (
+	"os"
 	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
 
 	"github.com/checkmarx/ast-cli/internal/commands/util"
+	"github.com/checkmarx/ast-cli/internal/logger"
 	commonParams "github.com/checkmarx/ast-cli/internal/params"
 	"github.com/google/uuid"
+	"github.com/pkg/errors"
 	"github.com/spf13/viper"
 )
 
@@ -13,6 +19,7 @@ import (
 type IContainerManager interface {
 	GenerateContainerID() string
 	RunKicsContainer(engine, volumeMap string) error
+	EnsureImageAvailable(engine string) error
 }
 
 // ContainerManager handles Docker container operations
@@ -29,12 +36,115 @@ func (dm *ContainerManager) GenerateContainerID() string {
 	return containerName
 }
 
+// createCommandWithEnhancedPath creates an exec.Cmd with an enhanced PATH that includes
+// Docker/Podman related directories. This is necessary on macOS when the IDE is launched
+// via GUI (double-click) because it doesn't inherit the shell's PATH environment variable.
+// Without this, Docker credential helpers like docker-credential-desktop won't be found.
+func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd {
+	cmd := exec.Command(enginePath, args...)
+
+	// Only enhance PATH on macOS
+	if runtime.GOOS != "darwin" {
+		return cmd
+	}
+
+	// Get current PATH
+	currentPath := os.Getenv("PATH")
+
+	// Build list of additional paths to add
+	var additionalPaths []string
+
+	// Add the directory containing the engine itself
+	engineDir := filepath.Dir(enginePath)
+	additionalPaths = append(additionalPaths, engineDir)
+
+	// Add common Docker-related directories that may contain credential helpers
+	additionalPaths = append(additionalPaths, "/usr/local/bin")
+	additionalPaths = append(additionalPaths, "/opt/homebrew/bin")
+	additionalPaths = append(additionalPaths, "/Applications/Docker.app/Contents/Resources/bin")
+
+	// Add user home-based paths
+	if homeDir, err := os.UserHomeDir(); err == nil {
+		additionalPaths = append(additionalPaths, filepath.Join(homeDir, ".docker", "bin"))
+		additionalPaths = append(additionalPaths, filepath.Join(homeDir, ".rd", "bin"))
+	}
+
+	// Build enhanced PATH (prepend additional paths to ensure they take priority)
+	var enhancedPathParts []string
+	for _, p := range additionalPaths {
+		// Only add if not already in PATH and directory exists
+		if !strings.Contains(currentPath, p) {
+			if _, err := os.Stat(p); err == nil {
+				enhancedPathParts = append(enhancedPathParts, p)
+			}
+		}
+	}
+	enhancedPathParts = append(enhancedPathParts, currentPath)
+	enhancedPath := strings.Join(enhancedPathParts, string(os.PathListSeparator))
+
+	// Set the enhanced PATH in the command's environment
+	cmd.Env = append(os.Environ(), "PATH="+enhancedPath)
+
+	logger.PrintIfVerbose("Enhanced PATH for container command: " + enhancedPath)
+
+	return cmd
+}
+
+// EnsureImageAvailable checks if the KICS Docker image exists locally and pulls it if not available
+func (dm *ContainerManager) EnsureImageAvailable(engine string) error {
+	logger.PrintIfVerbose("Resolving container engine: " + engine)
+
+	resolvedEngine, err := engineNameResolution(engine, IacEnginePath)
+	if err != nil {
+		logger.PrintIfVerbose("Failed to resolve container engine '" + engine + "': " + err.Error())
+		return errors.Wrapf(err, "container engine '%s' not found. On macOS, if Docker is installed but not found, "+
+			"try launching the IDE from terminal or ensure Docker Desktop is running", engine)
+	}
+
+	logger.PrintIfVerbose("Using container engine at: " + resolvedEngine)
+
+	// Check if image exists locally using 'docker image inspect'
+	logger.PrintIfVerbose("Checking if KICS image exists locally: " + util.ContainerImage)
+
+	inspectCmd := createCommandWithEnhancedPath(resolvedEngine, "image", "inspect", util.ContainerImage)
+	if err := inspectCmd.Run(); err == nil {
+		logger.PrintIfVerbose("KICS Docker image found locally: " + util.ContainerImage)
+		return nil
+	}
+
+	// Image not found locally, attempt to pull
+	logger.PrintIfVerbose("KICS Docker image not found locally. Attempting to pull: " + util.ContainerImage)
+
+	pullCmd := createCommandWithEnhancedPath(resolvedEngine, "pull", util.ContainerImage)
+	output, pullErr := pullCmd.CombinedOutput()
+	if pullErr != nil {
+		outputStr := strings.TrimSpace(string(output))
+		logger.PrintIfVerbose("Failed to pull KICS image. Output: " + outputStr)
+
+		if outputStr != "" {
+			return errors.Errorf("Failed to pull KICS Docker image '%s': %s. Please check your network connectivity or pull the image manually using: %s pull %s",
+				util.ContainerImage, outputStr, resolvedEngine, util.ContainerImage)
+		}
+		return errors.Errorf("Failed to pull KICS Docker image '%s': %v. Please check your network connectivity or pull the image manually using: %s pull %s",
+			util.ContainerImage, pullErr, resolvedEngine, util.ContainerImage)
+	}
+
+	logger.PrintIfVerbose("Successfully pulled KICS Docker image: " + util.ContainerImage)
+	return nil
+}
+
 func (dm *ContainerManager) RunKicsContainer(engine, volumeMap string) error {
-	engine, err := engineNameResolution(engine, IacEnginePath)
+	// Ensure the KICS image is available before running
+	if err := dm.EnsureImageAvailable(engine); err != nil {
+		return err
+	}
+
+	resolvedEngine, err := engineNameResolution(engine, IacEnginePath)
 	if err != nil {
 		return err
 	}
-	args := []string{
+
+	cmd := createCommandWithEnhancedPath(resolvedEngine,
 		"run", "--rm",
 		"-v", volumeMap,
 		"--name", viper.GetString(commonParams.KicsContainerNameKey),
@@ -43,8 +153,8 @@ func (dm *ContainerManager) RunKicsContainer(engine, volumeMap string) error {
 		"-p", ContainerPath,
 		"-o", ContainerPath,
 		"--report-formats", ContainerFormat,
-	}
-	_, err = exec.Command(engine, args...).CombinedOutput()
+	)
+	_, err = cmd.CombinedOutput()
 
 	return err
 }
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime.go b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
index 17f46ffb2..44ef8e98d 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
@@ -1,12 +1,14 @@
 package iacrealtime
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"time"
 
 	"github.com/checkmarx/ast-cli/internal/services/realtimeengine"
 	"github.com/checkmarx/ast-cli/internal/wrappers"
@@ -147,21 +149,90 @@ func (svc *IacRealtimeService) validateFilePath(filePath string) error {
 }
 
 func engineNameResolution(engineName, fallBackDir string) (string, error) {
-	var err error
-	if _, err = exec.LookPath(engineName); err == nil {
+	// First, try to find the engine in PATH (works when launched from terminal)
+	if _, err := exec.LookPath(engineName); err == nil {
 		return engineName, nil
 	}
-	if err != nil && getOS() == osWindows {
+
+	// On Windows, we don't have fallback paths - the engine must be in PATH
+	if getOS() == osWindows {
 		return "", errors.New(engineName + ": executable file not found in PATH")
 	}
-	fallbackPath := filepath.Join(fallBackDir, engineName)
-	info, err := os.Stat(fallbackPath)
-	if err == nil && !info.IsDir() {
-		return fallbackPath, nil
+
+	// On macOS/Linux, check multiple fallback paths
+	// This handles the case when IDE is launched via GUI and doesn't inherit shell PATH
+	fallbackPaths := getFallbackPaths(engineName, fallBackDir)
+
+	for _, fallbackPath := range fallbackPaths {
+		if verifyEnginePath(fallbackPath) {
+			return fallbackPath, nil
+		}
+	}
+
+	checkedPaths := make([]string, len(fallbackPaths))
+	copy(checkedPaths, fallbackPaths)
+	return "", errors.Errorf("%s not found in PATH or in fallback locations: %v", engineName, checkedPaths)
+}
+
+// getFallbackPaths returns a list of paths to check for the container engine
+func getFallbackPaths(engineName, fallBackDir string) []string {
+	var paths []string
+
+	// Add the primary fallback directory
+	paths = append(paths, filepath.Join(fallBackDir, engineName))
+
+	// On macOS, add additional paths based on engine type
+	if getOS() == osDarwin {
+		var additionalPaths []string
+		if engineName == "docker" {
+			additionalPaths = macOSDockerFallbackPaths
+		} else if engineName == "podman" {
+			additionalPaths = macOSPodmanFallbackPaths
+		}
+
+		for _, dir := range additionalPaths {
+			enginePath := filepath.Join(dir, engineName)
+			// Avoid duplicates
+			if enginePath != filepath.Join(fallBackDir, engineName) {
+				paths = append(paths, enginePath)
+			}
+		}
+
+		// Add user home-based paths
+		if homeDir, err := os.UserHomeDir(); err == nil {
+			if engineName == "docker" {
+				paths = append(paths, filepath.Join(homeDir, ".docker", "bin", "docker"))
+				paths = append(paths, filepath.Join(homeDir, ".rd", "bin", "docker"))
+			} else if engineName == "podman" {
+				paths = append(paths, filepath.Join(homeDir, ".local", "bin", "podman"))
+			}
+		}
+	}
+
+	return paths
+}
+
+// verifyEnginePath checks if the engine exists and is executable at the given path
+func verifyEnginePath(enginePath string) bool {
+	info, err := os.Stat(enginePath)
+	if err != nil || info.IsDir() {
+		return false
+	}
+
+	// Verify the engine can be executed with a timeout to prevent hanging
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, enginePath, "--version")
+	if err := cmd.Run(); err != nil {
+		return false
 	}
-	return "", errors.New(engineName + " not found in PATH or in " + IacEnginePath)
+
+	return true
 }
 
+const osDarwin = "darwin"
+
 var getOS = func() string {
 	return runtime.GOOS
 }

From 8f0e3895e3110f7b39b5001d85f989840fb3a3d9 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Thu, 29 Jan 2026 19:57:51 +0530
Subject: [PATCH 02/17] Refactor createCommandWithEnhancedPath to use macOS
 Docker fallback paths and improve PATH handling

---
 .../iacrealtime/container-manager.go          | 24 ++++++++++++++-----
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index 917fcd581..e9c76f212 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -59,9 +59,7 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	additionalPaths = append(additionalPaths, engineDir)
 
 	// Add common Docker-related directories that may contain credential helpers
-	additionalPaths = append(additionalPaths, "/usr/local/bin")
-	additionalPaths = append(additionalPaths, "/opt/homebrew/bin")
-	additionalPaths = append(additionalPaths, "/Applications/Docker.app/Contents/Resources/bin")
+	additionalPaths = append(additionalPaths, macOSDockerFallbackPaths...)
 
 	// Add user home-based paths
 	if homeDir, err := os.UserHomeDir(); err == nil {
@@ -69,11 +67,18 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 		additionalPaths = append(additionalPaths, filepath.Join(homeDir, ".rd", "bin"))
 	}
 
+	// Build a set of existing PATH entries for accurate duplicate detection
+	pathParts := strings.Split(currentPath, string(os.PathListSeparator))
+	pathSet := make(map[string]bool)
+	for _, part := range pathParts {
+		pathSet[part] = true
+	}
+
 	// Build enhanced PATH (prepend additional paths to ensure they take priority)
 	var enhancedPathParts []string
 	for _, p := range additionalPaths {
 		// Only add if not already in PATH and directory exists
-		if !strings.Contains(currentPath, p) {
+		if !pathSet[p] {
 			if _, err := os.Stat(p); err == nil {
 				enhancedPathParts = append(enhancedPathParts, p)
 			}
@@ -82,8 +87,15 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	enhancedPathParts = append(enhancedPathParts, currentPath)
 	enhancedPath := strings.Join(enhancedPathParts, string(os.PathListSeparator))
 
-	// Set the enhanced PATH in the command's environment
-	cmd.Env = append(os.Environ(), "PATH="+enhancedPath)
+	// Set the enhanced PATH in the command's environment (replace existing PATH)
+	env := os.Environ()
+	for i, e := range env {
+		if strings.HasPrefix(e, "PATH=") {
+			env[i] = "PATH=" + enhancedPath
+			break
+		}
+	}
+	cmd.Env = env
 
 	logger.PrintIfVerbose("Enhanced PATH for container command: " + enhancedPath)
 

From 1a2671139f2a43940e3b5e2c636e72751bfad0c5 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Thu, 29 Jan 2026 20:24:29 +0530
Subject: [PATCH 03/17] Enhance MockContainerManager to support image
 availability checks and add related fields

---
 .../iacrealtime/container-manager_test.go     | 31 ++++++++++++++-----
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager_test.go b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
index f1d93ace6..a43372a18 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager_test.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
@@ -12,11 +12,14 @@ import (
 
 // MockContainerManager for testing - does not execute real container commands
 type MockContainerManager struct {
-	GeneratedContainerIDs []string
-	RunKicsContainerCalls []RunKicsContainerCall
-	ShouldFailGenerate    bool
-	ShouldFailRun         bool
-	RunError              error
+	GeneratedContainerIDs      []string
+	RunKicsContainerCalls      []RunKicsContainerCall
+	EnsureImageAvailableCalls  []string
+	ShouldFailGenerate         bool
+	ShouldFailRun              bool
+	ShouldFailEnsureImage      bool
+	RunError                   error
+	EnsureImageError           error
 }
 
 type RunKicsContainerCall struct {
@@ -26,8 +29,9 @@ type RunKicsContainerCall struct {
 
 func NewMockContainerManager() *MockContainerManager {
 	return &MockContainerManager{
-		GeneratedContainerIDs: make([]string, 0),
-		RunKicsContainerCalls: make([]RunKicsContainerCall, 0),
+		GeneratedContainerIDs:     make([]string, 0),
+		RunKicsContainerCalls:     make([]RunKicsContainerCall, 0),
+		EnsureImageAvailableCalls: make([]string, 0),
 	}
 }
 
@@ -60,6 +64,19 @@ func (m *MockContainerManager) RunKicsContainer(engine, volumeMap string) error
 	return nil
 }
 
+func (m *MockContainerManager) EnsureImageAvailable(engine string) error {
+	m.EnsureImageAvailableCalls = append(m.EnsureImageAvailableCalls, engine)
+
+	if m.ShouldFailEnsureImage {
+		if m.EnsureImageError != nil {
+			return m.EnsureImageError
+		}
+		return &exec.Error{Name: engine, Err: nil}
+	}
+
+	return nil
+}
+
 func TestNewMockContainerManager(t *testing.T) {
 	dm := NewMockContainerManager()
 

From 7c9e8e8a29c7802866e7f455b77574642fb1cc5c Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Thu, 29 Jan 2026 20:38:58 +0530
Subject: [PATCH 04/17] Add container engine constants and enhance fallback
 path handling for macOS

---
 .../realtimeengine/iacrealtime/constants.go   |  7 +++++++
 .../iacrealtime/container-manager.go          |  7 ++++---
 .../iacrealtime/iac-realtime.go               | 19 +++++++++++--------
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/constants.go b/internal/services/realtimeengine/iacrealtime/constants.go
index 2880d7a69..7209e813f 100644
--- a/internal/services/realtimeengine/iacrealtime/constants.go
+++ b/internal/services/realtimeengine/iacrealtime/constants.go
@@ -8,6 +8,13 @@ const (
 	ContainerResultsFileName = "results.json"
 	InfoSeverity             = "info"
 	IacEnginePath            = "/usr/local/bin"
+
+	// Container engine names
+	engineDocker = "docker"
+	enginePodman = "podman"
+
+	// engineVerifyTimeout is the timeout in seconds for verifying container engine availability
+	engineVerifyTimeout = 5
 )
 
 // macOSDockerFallbackPaths contains additional paths to check for Docker on macOS
diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index e9c76f212..087369624 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -44,7 +44,7 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	cmd := exec.Command(enginePath, args...)
 
 	// Only enhance PATH on macOS
-	if runtime.GOOS != "darwin" {
+	if runtime.GOOS != osDarwin {
 		return cmd
 	}
 
@@ -63,8 +63,9 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 
 	// Add user home-based paths
 	if homeDir, err := os.UserHomeDir(); err == nil {
-		additionalPaths = append(additionalPaths, filepath.Join(homeDir, ".docker", "bin"))
-		additionalPaths = append(additionalPaths, filepath.Join(homeDir, ".rd", "bin"))
+		additionalPaths = append(additionalPaths,
+			filepath.Join(homeDir, ".docker", "bin"),
+			filepath.Join(homeDir, ".rd", "bin"))
 	}
 
 	// Build a set of existing PATH entries for accurate duplicate detection
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime.go b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
index 44ef8e98d..423240855 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
@@ -184,9 +184,10 @@ func getFallbackPaths(engineName, fallBackDir string) []string {
 	// On macOS, add additional paths based on engine type
 	if getOS() == osDarwin {
 		var additionalPaths []string
-		if engineName == "docker" {
+		switch engineName {
+		case engineDocker:
 			additionalPaths = macOSDockerFallbackPaths
-		} else if engineName == "podman" {
+		case enginePodman:
 			additionalPaths = macOSPodmanFallbackPaths
 		}
 
@@ -200,11 +201,13 @@ func getFallbackPaths(engineName, fallBackDir string) []string {
 
 		// Add user home-based paths
 		if homeDir, err := os.UserHomeDir(); err == nil {
-			if engineName == "docker" {
-				paths = append(paths, filepath.Join(homeDir, ".docker", "bin", "docker"))
-				paths = append(paths, filepath.Join(homeDir, ".rd", "bin", "docker"))
-			} else if engineName == "podman" {
-				paths = append(paths, filepath.Join(homeDir, ".local", "bin", "podman"))
+			switch engineName {
+			case engineDocker:
+				paths = append(paths,
+					filepath.Join(homeDir, ".docker", "bin", engineDocker),
+					filepath.Join(homeDir, ".rd", "bin", engineDocker))
+			case enginePodman:
+				paths = append(paths, filepath.Join(homeDir, ".local", "bin", enginePodman))
 			}
 		}
 	}
@@ -220,7 +223,7 @@ func verifyEnginePath(enginePath string) bool {
 	}
 
 	// Verify the engine can be executed with a timeout to prevent hanging
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), engineVerifyTimeout*time.Second)
 	defer cancel()
 
 	cmd := exec.CommandContext(ctx, enginePath, "--version")

From 14408e377fa9486faa21359cca29f072b537cf86 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Thu, 29 Jan 2026 20:50:48 +0530
Subject: [PATCH 05/17] Refactor MockContainerManager and enhance fallback path
 handling for unknown engines

---
 .../iacrealtime/container-manager_test.go        | 16 ++++++++--------
 .../realtimeengine/iacrealtime/iac-realtime.go   |  4 ++++
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager_test.go b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
index a43372a18..929a50b20 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager_test.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
@@ -12,14 +12,14 @@ import (
 
 // MockContainerManager for testing - does not execute real container commands
 type MockContainerManager struct {
-	GeneratedContainerIDs      []string
-	RunKicsContainerCalls      []RunKicsContainerCall
-	EnsureImageAvailableCalls  []string
-	ShouldFailGenerate         bool
-	ShouldFailRun              bool
-	ShouldFailEnsureImage      bool
-	RunError                   error
-	EnsureImageError           error
+	GeneratedContainerIDs     []string
+	RunKicsContainerCalls     []RunKicsContainerCall
+	EnsureImageAvailableCalls []string
+	ShouldFailGenerate        bool
+	ShouldFailRun             bool
+	ShouldFailEnsureImage     bool
+	RunError                  error
+	EnsureImageError          error
 }
 
 type RunKicsContainerCall struct {
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime.go b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
index 423240855..7fc8455ea 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
@@ -189,6 +189,8 @@ func getFallbackPaths(engineName, fallBackDir string) []string {
 			additionalPaths = macOSDockerFallbackPaths
 		case enginePodman:
 			additionalPaths = macOSPodmanFallbackPaths
+		default:
+			// Unknown engine, no additional paths
 		}
 
 		for _, dir := range additionalPaths {
@@ -208,6 +210,8 @@ func getFallbackPaths(engineName, fallBackDir string) []string {
 					filepath.Join(homeDir, ".rd", "bin", engineDocker))
 			case enginePodman:
 				paths = append(paths, filepath.Join(homeDir, ".local", "bin", enginePodman))
+			default:
+				// Unknown engine, no home-based paths
 			}
 		}
 	}

From 6f69b52ec5203bda78eba8eb08c38dd862d12968 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Thu, 29 Jan 2026 21:53:00 +0530
Subject: [PATCH 06/17] Add tests for MockContainerManager and enhance fallback
 path handling for macOS

---
 .../iacrealtime/container-manager_test.go     |  74 ++++++
 .../iacrealtime/iac-realtime_test.go          | 217 ++++++++++++++++++
 2 files changed, 291 insertions(+)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager_test.go b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
index 929a50b20..54b966b7f 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager_test.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
@@ -282,3 +282,77 @@ func TestMockContainerManager_Integration(t *testing.T) {
 		t.Errorf("Mock should record correct call parameters: %+v", call)
 	}
 }
+
+func TestMockContainerManager_EnsureImageAvailable(t *testing.T) {
+	dm := NewMockContainerManager()
+
+	err := dm.EnsureImageAvailable("docker")
+	if err != nil {
+		t.Errorf("EnsureImageAvailable should not fail by default: %v", err)
+	}
+
+	if len(dm.EnsureImageAvailableCalls) != 1 {
+		t.Error("Mock should record EnsureImageAvailable call")
+	}
+
+	if dm.EnsureImageAvailableCalls[0] != "docker" {
+		t.Errorf("Mock should record correct engine, got %s", dm.EnsureImageAvailableCalls[0])
+	}
+}
+
+func TestMockContainerManager_EnsureImageAvailable_Failure(t *testing.T) {
+	dm := NewMockContainerManager()
+	dm.ShouldFailEnsureImage = true
+
+	err := dm.EnsureImageAvailable("docker")
+	if err == nil {
+		t.Error("EnsureImageAvailable should fail when configured to fail")
+	}
+
+	// Verify call was still recorded
+	if len(dm.EnsureImageAvailableCalls) != 1 {
+		t.Error("Mock should record the call even when configured to fail")
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_ReturnsCommand(t *testing.T) {
+	cmd := createCommandWithEnhancedPath("/usr/bin/docker", "run", "--rm", "hello-world")
+
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	if cmd.Path == "" {
+		t.Error("Command should have a path set")
+	}
+
+	// Verify args are passed correctly
+	expectedArgs := []string{"/usr/bin/docker", "run", "--rm", "hello-world"}
+	if len(cmd.Args) != len(expectedArgs) {
+		t.Errorf("Expected %d args, got %d", len(expectedArgs), len(cmd.Args))
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_NoArgs(t *testing.T) {
+	cmd := createCommandWithEnhancedPath("/usr/bin/docker")
+
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	if len(cmd.Args) != 1 {
+		t.Errorf("Expected 1 arg, got %d", len(cmd.Args))
+	}
+}
+
+func TestMockContainerManager_EnsureImageAvailable_CustomError(t *testing.T) {
+	dm := NewMockContainerManager()
+	dm.ShouldFailEnsureImage = true
+	customErr := &exec.Error{Name: "custom", Err: nil}
+	dm.EnsureImageError = customErr
+
+	err := dm.EnsureImageAvailable("docker")
+	if err != customErr {
+		t.Error("EnsureImageAvailable should return custom error when set")
+	}
+}
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
index 1ce51c145..74670ef27 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
@@ -510,3 +510,220 @@ func TestEngineName_Resolution_check_fallBackPath_for_MAC_Linux(t *testing.T) {
 		t.Fatalf("expected %q, got %q", expected, result)
 	}
 }
+
+func TestGetFallbackPaths_Docker_Darwin(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	fallbackDir := "/test/fallback"
+	paths := getFallbackPaths(engineDocker, fallbackDir)
+
+	// Should contain primary fallback path
+	expectedPrimary := filepath.Join(fallbackDir, engineDocker)
+	found := false
+	for _, p := range paths {
+		if p == expectedPrimary {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("Expected primary fallback path %s in paths", expectedPrimary)
+	}
+
+	// Should contain macOS Docker fallback paths
+	for _, macPath := range macOSDockerFallbackPaths {
+		expectedPath := filepath.Join(macPath, engineDocker)
+		if expectedPath == expectedPrimary {
+			continue // Skip if same as primary
+		}
+		found = false
+		for _, p := range paths {
+			if p == expectedPath {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("Expected macOS fallback path %s in paths", expectedPath)
+		}
+	}
+}
+
+func TestGetFallbackPaths_Podman_Darwin(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	fallbackDir := "/test/fallback"
+	paths := getFallbackPaths(enginePodman, fallbackDir)
+
+	// Should contain primary fallback path
+	expectedPrimary := filepath.Join(fallbackDir, enginePodman)
+	found := false
+	for _, p := range paths {
+		if p == expectedPrimary {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("Expected primary fallback path %s in paths", expectedPrimary)
+	}
+
+	// Should contain macOS Podman fallback paths
+	for _, macPath := range macOSPodmanFallbackPaths {
+		expectedPath := filepath.Join(macPath, enginePodman)
+		if expectedPath == expectedPrimary {
+			continue // Skip if same as primary
+		}
+		found = false
+		for _, p := range paths {
+			if p == expectedPath {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("Expected macOS fallback path %s in paths", expectedPath)
+		}
+	}
+}
+
+func TestGetFallbackPaths_NonDarwin(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return "linux" }
+
+	fallbackDir := "/test/fallback"
+	paths := getFallbackPaths(engineDocker, fallbackDir)
+
+	// On non-darwin, should only contain primary fallback path
+	if len(paths) != 1 {
+		t.Errorf("Expected 1 path on non-darwin, got %d", len(paths))
+	}
+
+	expectedPrimary := filepath.Join(fallbackDir, engineDocker)
+	if paths[0] != expectedPrimary {
+		t.Errorf("Expected %s, got %s", expectedPrimary, paths[0])
+	}
+}
+
+func TestGetFallbackPaths_UnknownEngine_Darwin(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	fallbackDir := "/test/fallback"
+	paths := getFallbackPaths("unknown-engine", fallbackDir)
+
+	// Should only contain primary fallback path for unknown engine
+	expectedPrimary := filepath.Join(fallbackDir, "unknown-engine")
+	if len(paths) != 1 {
+		t.Errorf("Expected 1 path for unknown engine, got %d", len(paths))
+	}
+	if paths[0] != expectedPrimary {
+		t.Errorf("Expected %s, got %s", expectedPrimary, paths[0])
+	}
+}
+
+func TestVerifyEnginePath_NonExistentPath(t *testing.T) {
+	result := verifyEnginePath("/non/existent/path/to/engine")
+	if result {
+		t.Error("verifyEnginePath should return false for non-existent path")
+	}
+}
+
+func TestVerifyEnginePath_Directory(t *testing.T) {
+	tempDir := t.TempDir()
+	result := verifyEnginePath(tempDir)
+	if result {
+		t.Error("verifyEnginePath should return false for directory")
+	}
+}
+
+func TestGetFallbackPaths_Docker_Darwin_IncludesHomePaths(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	fallbackDir := "/different/fallback"
+	paths := getFallbackPaths(engineDocker, fallbackDir)
+
+	// Get user home directory
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		t.Skipf("Cannot get user home directory: %v", err)
+	}
+
+	// Should contain home-based Docker paths
+	expectedDockerHome := filepath.Join(homeDir, ".docker", "bin", engineDocker)
+	expectedRdHome := filepath.Join(homeDir, ".rd", "bin", engineDocker)
+
+	foundDockerHome := false
+	foundRdHome := false
+	for _, p := range paths {
+		if p == expectedDockerHome {
+			foundDockerHome = true
+		}
+		if p == expectedRdHome {
+			foundRdHome = true
+		}
+	}
+
+	if !foundDockerHome {
+		t.Errorf("Expected Docker home path %s in paths", expectedDockerHome)
+	}
+	if !foundRdHome {
+		t.Errorf("Expected Rancher Desktop home path %s in paths", expectedRdHome)
+	}
+}
+
+func TestGetFallbackPaths_Podman_Darwin_IncludesHomePaths(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	fallbackDir := "/different/fallback"
+	paths := getFallbackPaths(enginePodman, fallbackDir)
+
+	// Get user home directory
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		t.Skipf("Cannot get user home directory: %v", err)
+	}
+
+	// Should contain home-based Podman path
+	expectedPodmanHome := filepath.Join(homeDir, ".local", "bin", enginePodman)
+
+	foundPodmanHome := false
+	for _, p := range paths {
+		if p == expectedPodmanHome {
+			foundPodmanHome = true
+		}
+	}
+
+	if !foundPodmanHome {
+		t.Errorf("Expected Podman home path %s in paths", expectedPodmanHome)
+	}
+}
+
+func TestGetFallbackPaths_Windows(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osWindows }
+
+	fallbackDir := "C:\\test\\fallback"
+	paths := getFallbackPaths(engineDocker, fallbackDir)
+
+	// On Windows, should only contain primary fallback path
+	if len(paths) != 1 {
+		t.Errorf("Expected 1 path on Windows, got %d", len(paths))
+	}
+
+	expectedPrimary := filepath.Join(fallbackDir, engineDocker)
+	if paths[0] != expectedPrimary {
+		t.Errorf("Expected %s, got %s", expectedPrimary, paths[0])
+	}
+}

From a4526a64a70edffdc8a18bd640dabb549e3054dc Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Thu, 29 Jan 2026 22:15:28 +0530
Subject: [PATCH 07/17] Refactor fallback path handling in tests to use
 constants for improved maintainability

---
 .../iacrealtime/iac-realtime_test.go            | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
index 74670ef27..53f5177be 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
@@ -11,6 +11,11 @@ import (
 	"github.com/checkmarx/ast-cli/internal/wrappers/mock"
 )
 
+const (
+	testFallbackDir          = "/test/fallback"
+	testDifferentFallbackDir = "/different/fallback"
+)
+
 func TestNewIacRealtimeService(t *testing.T) {
 	mockJWT := &mock.JWTMockWrapper{}
 	mockFlags := &mock.FeatureFlagsMockWrapper{}
@@ -516,7 +521,7 @@ func TestGetFallbackPaths_Docker_Darwin(t *testing.T) {
 	defer func() { getOS = origGOOS }()
 	getOS = func() string { return osDarwin }
 
-	fallbackDir := "/test/fallback"
+	fallbackDir := testFallbackDir
 	paths := getFallbackPaths(engineDocker, fallbackDir)
 
 	// Should contain primary fallback path
@@ -556,7 +561,7 @@ func TestGetFallbackPaths_Podman_Darwin(t *testing.T) {
 	defer func() { getOS = origGOOS }()
 	getOS = func() string { return osDarwin }
 
-	fallbackDir := "/test/fallback"
+	fallbackDir := testFallbackDir
 	paths := getFallbackPaths(enginePodman, fallbackDir)
 
 	// Should contain primary fallback path
@@ -596,7 +601,7 @@ func TestGetFallbackPaths_NonDarwin(t *testing.T) {
 	defer func() { getOS = origGOOS }()
 	getOS = func() string { return "linux" }
 
-	fallbackDir := "/test/fallback"
+	fallbackDir := testFallbackDir
 	paths := getFallbackPaths(engineDocker, fallbackDir)
 
 	// On non-darwin, should only contain primary fallback path
@@ -615,7 +620,7 @@ func TestGetFallbackPaths_UnknownEngine_Darwin(t *testing.T) {
 	defer func() { getOS = origGOOS }()
 	getOS = func() string { return osDarwin }
 
-	fallbackDir := "/test/fallback"
+	fallbackDir := testFallbackDir
 	paths := getFallbackPaths("unknown-engine", fallbackDir)
 
 	// Should only contain primary fallback path for unknown engine
@@ -648,7 +653,7 @@ func TestGetFallbackPaths_Docker_Darwin_IncludesHomePaths(t *testing.T) {
 	defer func() { getOS = origGOOS }()
 	getOS = func() string { return osDarwin }
 
-	fallbackDir := "/different/fallback"
+	fallbackDir := testDifferentFallbackDir
 	paths := getFallbackPaths(engineDocker, fallbackDir)
 
 	// Get user home directory
@@ -685,7 +690,7 @@ func TestGetFallbackPaths_Podman_Darwin_IncludesHomePaths(t *testing.T) {
 	defer func() { getOS = origGOOS }()
 	getOS = func() string { return osDarwin }
 
-	fallbackDir := "/different/fallback"
+	fallbackDir := testDifferentFallbackDir
 	paths := getFallbackPaths(enginePodman, fallbackDir)
 
 	// Get user home directory

From aaa704c366a8a874dbc4a898cdf5b193c64ac0cf Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Fri, 30 Jan 2026 11:33:19 +0530
Subject: [PATCH 08/17] Add redundancy tests for ScanResult and related
 functions

---
 internal/commands/results-redundancy_test.go | 942 +++++++++++++++++++
 1 file changed, 942 insertions(+)
 create mode 100644 internal/commands/results-redundancy_test.go

diff --git a/internal/commands/results-redundancy_test.go b/internal/commands/results-redundancy_test.go
new file mode 100644
index 000000000..adf57549d
--- /dev/null
+++ b/internal/commands/results-redundancy_test.go
@@ -0,0 +1,942 @@
+//go:build !integration
+
+package commands
+
+import (
+	"testing"
+
+	"github.com/checkmarx/ast-cli/internal/wrappers"
+	"github.com/stretchr/testify/assert"
+)
+
+// Helper function to create a mock ScanResult with nodes for redundancy tests
+func createRedundancyTestResult(id, language, queryName string, nodes []*wrappers.ScanResultNode) *wrappers.ScanResult {
+	return &wrappers.ScanResult{
+		ID: id,
+		ScanResultData: wrappers.ScanResultData{
+			LanguageName: language,
+			QueryName:    queryName,
+			Nodes:        nodes,
+		},
+	}
+}
+
+// Helper function to create a mock ScanResultNode for redundancy tests
+func createRedundancyTestNode(fileName string, line, column uint) *wrappers.ScanResultNode {
+	return &wrappers.ScanResultNode{
+		FileName: fileName,
+		Line:     line,
+		Column:   column,
+	}
+}
+
+// TestGetLanguages tests the GetLanguages function
+func TestGetLanguages(t *testing.T) {
+	tests := []struct {
+		name     string
+		results  *wrappers.ScanResultsCollection
+		expected map[string]bool
+	}{
+		{
+			name:     "Empty results",
+			results:  &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}},
+			expected: map[string]bool{},
+		},
+		{
+			name: "Single language",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "query1", nil),
+				},
+			},
+			expected: map[string]bool{"Java": true},
+		},
+		{
+			name: "Multiple languages",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "query1", nil),
+					createRedundancyTestResult("2", "Python", "query2", nil),
+					createRedundancyTestResult("3", "JavaScript", "query3", nil),
+				},
+			},
+			expected: map[string]bool{"Java": true, "Python": true, "JavaScript": true},
+		},
+		{
+			name: "Duplicate languages",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "query1", nil),
+					createRedundancyTestResult("2", "Java", "query2", nil),
+					createRedundancyTestResult("3", "Python", "query3", nil),
+				},
+			},
+			expected: map[string]bool{"Java": true, "Python": true},
+		},
+		{
+			name: "Empty language name skipped",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "query1", nil),
+					createRedundancyTestResult("2", "", "query2", nil),
+				},
+			},
+			expected: map[string]bool{"Java": true},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := GetLanguages(tt.results)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestGetQueries tests the GetQueries function
+func TestGetQueries(t *testing.T) {
+	tests := []struct {
+		name      string
+		results   *wrappers.ScanResultsCollection
+		languages map[string]bool
+		expected  map[string]map[string]bool
+	}{
+		{
+			name:      "Empty results",
+			results:   &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}},
+			languages: map[string]bool{"Java": true},
+			expected:  map[string]map[string]bool{},
+		},
+		{
+			name: "Single language single query",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
+				},
+			},
+			languages: map[string]bool{"Java": true},
+			expected:  map[string]map[string]bool{"Java": {"SQL_Injection": true}},
+		},
+		{
+			name: "Multiple queries per language",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
+					createRedundancyTestResult("2", "Java", "XSS", nil),
+					createRedundancyTestResult("3", "Python", "Command_Injection", nil),
+				},
+			},
+			languages: map[string]bool{"Java": true, "Python": true},
+			expected: map[string]map[string]bool{
+				"Java":   {"SQL_Injection": true, "XSS": true},
+				"Python": {"Command_Injection": true},
+			},
+		},
+		{
+			name: "Language not in filter skipped",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
+					createRedundancyTestResult("2", "Ruby", "XSS", nil),
+				},
+			},
+			languages: map[string]bool{"Java": true},
+			expected:  map[string]map[string]bool{"Java": {"SQL_Injection": true}},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := GetQueries(tt.results, tt.languages)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestGetKey tests the GetKey function
+func TestGetKey(t *testing.T) {
+	tests := []struct {
+		name     string
+		r1       string
+		r2       string
+		expected string
+	}{
+		{
+			name:     "r1 less than r2",
+			r1:       "a",
+			r2:       "b",
+			expected: "a,b",
+		},
+		{
+			name:     "r2 less than r1",
+			r1:       "b",
+			r2:       "a",
+			expected: "a,b",
+		},
+		{
+			name:     "Same values",
+			r1:       "same",
+			r2:       "same",
+			expected: "same,same",
+		},
+		{
+			name:     "Numeric strings",
+			r1:       "123",
+			r2:       "456",
+			expected: "123,456",
+		},
+		{
+			name:     "Empty strings",
+			r1:       "",
+			r2:       "a",
+			expected: ",a",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := GetKey(tt.r1, tt.r2)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestRoundFloat tests the roundFloat function
+func TestRoundFloat(t *testing.T) {
+	tests := []struct {
+		name      string
+		val       float64
+		precision uint
+		expected  float64
+	}{
+		{
+			name:      "Round down",
+			val:       1.234,
+			precision: 2,
+			expected:  1.23,
+		},
+		{
+			name:      "Round up",
+			val:       1.235,
+			precision: 2,
+			expected:  1.24,
+		},
+		{
+			name:      "No decimal places",
+			val:       1.5,
+			precision: 0,
+			expected:  2.0,
+		},
+		{
+			name:      "Already rounded",
+			val:       1.0,
+			precision: 2,
+			expected:  1.0,
+		},
+		{
+			name:      "High precision",
+			val:       1.23456789,
+			precision: 4,
+			expected:  1.2346,
+		},
+		{
+			name:      "Zero value",
+			val:       0.0,
+			precision: 2,
+			expected:  0.0,
+		},
+		{
+			name:      "Negative value",
+			val:       -1.234,
+			precision: 2,
+			expected:  -1.23,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := roundFloat(tt.val, tt.precision)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestGetSha1String tests the getSha1String function
+func TestGetSha1String(t *testing.T) {
+	tests := []struct {
+		name  string
+		lines []string
+	}{
+		{
+			name:  "Single line",
+			lines: []string{"hello"},
+		},
+		{
+			name:  "Multiple lines",
+			lines: []string{"hello", "world"},
+		},
+		{
+			name:  "Empty slice",
+			lines: []string{},
+		},
+		{
+			name:  "Lines with special characters",
+			lines: []string{"file.go:10:5", "file.go:20:10"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := getSha1String(tt.lines)
+			assert.NotEmpty(t, result)
+			// Verify deterministic output
+			result2 := getSha1String(tt.lines)
+			assert.Equal(t, result, result2)
+			// SHA1 produces 40 character hex string
+			assert.Len(t, result, 40)
+		})
+	}
+
+	// Test that different inputs produce different outputs
+	t.Run("Different inputs produce different outputs", func(t *testing.T) {
+		result1 := getSha1String([]string{"a", "b"})
+		result2 := getSha1String([]string{"c", "d"})
+		assert.NotEqual(t, result1, result2)
+	})
+}
+
+// TestGetResultsForQuery tests the GetResultsForQuery function
+func TestGetResultsForQuery(t *testing.T) {
+	tests := []struct {
+		name        string
+		results     *wrappers.ScanResultsCollection
+		language    string
+		query       string
+		expectedLen int
+		expectedIDs []string
+	}{
+		{
+			name:        "Empty results",
+			results:     &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}},
+			language:    "Java",
+			query:       "SQL_Injection",
+			expectedLen: 0,
+			expectedIDs: nil,
+		},
+		{
+			name: "Single matching result",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
+				},
+			},
+			language:    "Java",
+			query:       "SQL_Injection",
+			expectedLen: 1,
+			expectedIDs: []string{"1"},
+		},
+		{
+			name: "Multiple matching results sorted by ID",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("3", "Java", "SQL_Injection", nil),
+					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
+					createRedundancyTestResult("2", "Java", "SQL_Injection", nil),
+				},
+			},
+			language:    "Java",
+			query:       "SQL_Injection",
+			expectedLen: 3,
+			expectedIDs: []string{"1", "2", "3"},
+		},
+		{
+			name: "Filter by language",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
+					createRedundancyTestResult("2", "Python", "SQL_Injection", nil),
+				},
+			},
+			language:    "Java",
+			query:       "SQL_Injection",
+			expectedLen: 1,
+			expectedIDs: []string{"1"},
+		},
+		{
+			name: "Filter by query",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
+					createRedundancyTestResult("2", "Java", "XSS", nil),
+				},
+			},
+			language:    "Java",
+			query:       "SQL_Injection",
+			expectedLen: 1,
+			expectedIDs: []string{"1"},
+		},
+		{
+			name: "No matching results",
+			results: &wrappers.ScanResultsCollection{
+				Results: []*wrappers.ScanResult{
+					createRedundancyTestResult("1", "Java", "XSS", nil),
+				},
+			},
+			language:    "Java",
+			query:       "SQL_Injection",
+			expectedLen: 0,
+			expectedIDs: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := GetResultsForQuery(tt.results, tt.language, tt.query)
+			assert.Len(t, result, tt.expectedLen)
+			if tt.expectedIDs != nil {
+				for i, expectedID := range tt.expectedIDs {
+					assert.Equal(t, expectedID, result[i].ID)
+				}
+			}
+		})
+	}
+}
+
+// TestGetResultForID tests the getResultForID function
+func TestGetResultForID(t *testing.T) {
+	results := []*wrappers.ScanResult{
+		createRedundancyTestResult("1", "Java", "query1", nil),
+		createRedundancyTestResult("2", "Python", "query2", nil),
+		createRedundancyTestResult("3", "JavaScript", "query3", nil),
+	}
+
+	tests := []struct {
+		name     string
+		resultID string
+		expected *wrappers.ScanResult
+	}{
+		{
+			name:     "Find existing result",
+			resultID: "2",
+			expected: results[1],
+		},
+		{
+			name:     "Result not found",
+			resultID: "999",
+			expected: nil,
+		},
+		{
+			name:     "Empty ID",
+			resultID: "",
+			expected: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := getResultForID(results, tt.resultID)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestBuildFlows tests the buildFlows function
+func TestBuildFlows(t *testing.T) {
+	tests := []struct {
+		name         string
+		queryResults []*wrappers.ScanResult
+		expectedKeys []string
+	}{
+		{
+			name:         "Empty results",
+			queryResults: []*wrappers.ScanResult{},
+			expectedKeys: []string{},
+		},
+		{
+			name: "Single result with nodes",
+			queryResults: []*wrappers.ScanResult{
+				createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
+					createRedundancyTestNode("file.java", 10, 5),
+					createRedundancyTestNode("file.java", 20, 10),
+				}),
+			},
+			expectedKeys: []string{"1"},
+		},
+		{
+			name: "Multiple results",
+			queryResults: []*wrappers.ScanResult{
+				createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
+					createRedundancyTestNode("file.java", 10, 5),
+				}),
+				createRedundancyTestResult("2", "Java", "query", []*wrappers.ScanResultNode{
+					createRedundancyTestNode("file.java", 20, 10),
+				}),
+			},
+			expectedKeys: []string{"1", "2"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := buildFlows(tt.queryResults)
+			assert.Len(t, result, len(tt.expectedKeys))
+			for _, key := range tt.expectedKeys {
+				_, exists := result[key]
+				assert.True(t, exists, "Expected key %s to exist", key)
+			}
+		})
+	}
+}
+
+// TestBuildFlows_NodeFormat tests that buildFlows creates correct node string format
+func TestBuildFlows_NodeFormat(t *testing.T) {
+	queryResults := []*wrappers.ScanResult{
+		createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
+			createRedundancyTestNode("file.java", 10, 5),
+			createRedundancyTestNode("file.java", 20, 10),
+		}),
+	}
+
+	result := buildFlows(queryResults)
+	flows := result["1"]
+
+	assert.Len(t, flows, 2)
+	assert.Equal(t, "file.java:10:5", flows[0])
+	assert.Equal(t, "file.java:20:10", flows[1])
+}
+
+// TestSortSubFlowIDs tests the sortSubFlowIDs function
+func TestSortSubFlowIDs(t *testing.T) {
+	tests := []struct {
+		name     string
+		subFlows map[string]*SubFlow
+		expected []string
+	}{
+		{
+			name:     "Empty map",
+			subFlows: map[string]*SubFlow{},
+			expected: nil,
+		},
+		{
+			name: "Single subflow",
+			subFlows: map[string]*SubFlow{
+				"abc": {ShaOne: "abc"},
+			},
+			expected: []string{"abc"},
+		},
+		{
+			name: "Multiple subflows sorted",
+			subFlows: map[string]*SubFlow{
+				"zzz": {ShaOne: "zzz"},
+				"aaa": {ShaOne: "aaa"},
+				"mmm": {ShaOne: "mmm"},
+			},
+			expected: []string{"aaa", "mmm", "zzz"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := sortSubFlowIDs(tt.subFlows)
+			if tt.expected == nil {
+				assert.Nil(t, result)
+			} else {
+				assert.Equal(t, tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestSortSubFlowResultIDs tests the sortSubFlowResultIDs function
+func TestSortSubFlowResultIDs(t *testing.T) {
+	tests := []struct {
+		name     string
+		subFlow  *SubFlow
+		expected []string
+	}{
+		{
+			name: "Empty results",
+			subFlow: &SubFlow{
+				Results: map[string]bool{},
+			},
+			expected: nil,
+		},
+		{
+			name: "Single result",
+			subFlow: &SubFlow{
+				Results: map[string]bool{"1": true},
+			},
+			expected: []string{"1"},
+		},
+		{
+			name: "Multiple results sorted",
+			subFlow: &SubFlow{
+				Results: map[string]bool{
+					"3": true,
+					"1": true,
+					"2": true,
+				},
+			},
+			expected: []string{"1", "2", "3"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := sortSubFlowResultIDs(tt.subFlow)
+			if tt.expected == nil {
+				assert.Nil(t, result)
+			} else {
+				assert.Equal(t, tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestGetMaxCoverage tests the getMaxCoverage function
+func TestGetMaxCoverage(t *testing.T) {
+	tests := []struct {
+		name                string
+		coverage            map[string]float64
+		expectedID          string
+		expectedMaxCoverage float64
+	}{
+		{
+			name:                "Empty coverage",
+			coverage:            map[string]float64{},
+			expectedID:          "",
+			expectedMaxCoverage: 0.0,
+		},
+		{
+			name:                "Single entry",
+			coverage:            map[string]float64{"1": 0.75},
+			expectedID:          "1",
+			expectedMaxCoverage: 0.75,
+		},
+		{
+			name:                "Multiple entries",
+			coverage:            map[string]float64{"1": 0.5, "2": 0.8, "3": 0.6},
+			expectedID:          "2",
+			expectedMaxCoverage: 0.8,
+		},
+		{
+			name:                "Tie goes to lexically first",
+			coverage:            map[string]float64{"b": 0.5, "a": 0.5},
+			expectedID:          "a",
+			expectedMaxCoverage: 0.5,
+		},
+		{
+			name:                "All zero coverage",
+			coverage:            map[string]float64{"1": 0.0, "2": 0.0},
+			expectedID:          "",
+			expectedMaxCoverage: 0.0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resultID, maxCov := getMaxCoverage(tt.coverage)
+			assert.Equal(t, tt.expectedID, resultID)
+			assert.Equal(t, tt.expectedMaxCoverage, maxCov)
+		})
+	}
+}
+
+// TestComputeSubFlow tests the computeSubFlow function
+func TestComputeSubFlow(t *testing.T) {
+	tests := []struct {
+		name         string
+		f1           []string
+		f2           []string
+		expectExists bool
+		expectedFlow []string
+	}{
+		{
+			name:         "No common elements",
+			f1:           []string{"a", "b", "c"},
+			f2:           []string{"d", "e", "f"},
+			expectExists: false,
+			expectedFlow: nil,
+		},
+		{
+			name:         "Exact match",
+			f1:           []string{"a", "b", "c"},
+			f2:           []string{"a", "b", "c"},
+			expectExists: true,
+			expectedFlow: []string{"a", "b", "c"},
+		},
+		{
+			name:         "Partial match at start",
+			f1:           []string{"a", "b", "c"},
+			f2:           []string{"a", "b", "d"},
+			expectExists: true,
+			expectedFlow: []string{"a", "b"},
+		},
+		{
+			name:         "Common subsequence in middle",
+			f1:           []string{"x", "a", "b", "y"},
+			f2:           []string{"z", "a", "b", "w"},
+			expectExists: true,
+			expectedFlow: []string{"a", "b"},
+		},
+		{
+			name:         "Single common element",
+			f1:           []string{"a", "b", "c"},
+			f2:           []string{"x", "a", "y"},
+			expectExists: true,
+			expectedFlow: []string{"a"},
+		},
+		{
+			name:         "Empty first flow",
+			f1:           []string{},
+			f2:           []string{"a", "b"},
+			expectExists: false,
+			expectedFlow: nil,
+		},
+		{
+			name:         "Empty second flow",
+			f1:           []string{"a", "b"},
+			f2:           []string{},
+			expectExists: false,
+			expectedFlow: nil,
+		},
+		{
+			name:         "Both flows empty",
+			f1:           []string{},
+			f2:           []string{},
+			expectExists: false,
+			expectedFlow: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			exists, subFlow := computeSubFlow(tt.f1, tt.f2)
+			assert.Equal(t, tt.expectExists, exists)
+			if tt.expectExists {
+				assert.NotNil(t, subFlow)
+				assert.Equal(t, tt.expectedFlow, subFlow.Flow)
+				assert.NotEmpty(t, subFlow.ShaOne)
+			} else {
+				assert.Nil(t, subFlow)
+			}
+		})
+	}
+}
+
+// TestCompareFlows tests the compareFlows function
+func TestCompareFlows(t *testing.T) {
+	tests := []struct {
+		name     string
+		flows    map[string][]string
+		expected int // number of subflows expected
+	}{
+		{
+			name:     "Empty flows",
+			flows:    map[string][]string{},
+			expected: 0,
+		},
+		{
+			name: "Single flow",
+			flows: map[string][]string{
+				"1": {"a", "b", "c"},
+			},
+			expected: 0,
+		},
+		{
+			name: "Two flows with common subflow",
+			flows: map[string][]string{
+				"1": {"a", "b", "c"},
+				"2": {"a", "b", "d"},
+			},
+			expected: 1,
+		},
+		{
+			name: "Two flows with no common subflow",
+			flows: map[string][]string{
+				"1": {"a", "b", "c"},
+				"2": {"d", "e", "f"},
+			},
+			expected: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := compareFlows(tt.flows)
+			assert.Len(t, result, tt.expected)
+		})
+	}
+}
+
+// TestLabelRedundantResults tests the labelRedundantResults function
+func TestLabelRedundantResults(t *testing.T) {
+	t.Run("Labels fix for results with no redundant entries", func(t *testing.T) {
+		results := []*wrappers.ScanResult{
+			createRedundancyTestResult("1", "Java", "query", nil),
+		}
+		redundantResults := map[string]map[string]bool{
+			"1": {}, // Empty map means no redundancy
+		}
+		labelRedundantResults(results, redundantResults)
+		assert.Equal(t, "fix", results[0].ScanResultData.Redundancy)
+	})
+
+	t.Run("Labels redundant for results with redundant entries", func(t *testing.T) {
+		results := []*wrappers.ScanResult{
+			createRedundancyTestResult("1", "Java", "query", nil),
+			createRedundancyTestResult("2", "Java", "query", nil),
+		}
+		redundantResults := map[string]map[string]bool{
+			"1": {},          // This is the fix
+			"2": {"1": true}, // This is redundant to 1
+		}
+		labelRedundantResults(results, redundantResults)
+		assert.Equal(t, "fix", results[0].ScanResultData.Redundancy)
+		assert.Equal(t, "redundant", results[1].ScanResultData.Redundancy)
+	})
+}
+
+// TestComputeRedundantResults tests the computeRedundantResults function
+func TestComputeRedundantResults(t *testing.T) {
+	t.Run("Empty subflows returns all empty redundant maps", func(t *testing.T) {
+		results := []*wrappers.ScanResult{
+			createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
+				createRedundancyTestNode("file.java", 10, 5),
+			}),
+		}
+		subFlows := map[string]*SubFlow{}
+
+		redundant := computeRedundantResults(subFlows, results)
+
+		assert.Len(t, redundant, 1)
+		assert.Len(t, redundant["1"], 0)
+	})
+
+	t.Run("High coverage marks redundancy", func(t *testing.T) {
+		// Result 1 has 2 nodes, Result 2 has 4 nodes
+		// Subflow has 2 nodes
+		// Coverage for 1 = 2/2 = 1.0 (100%)
+		// Coverage for 2 = 2/4 = 0.5 (50%)
+		// Since result 1 has higher coverage, result 2 is redundant to 1
+		results := []*wrappers.ScanResult{
+			createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
+				createRedundancyTestNode("file.java", 10, 5),
+				createRedundancyTestNode("file.java", 20, 10),
+			}),
+			createRedundancyTestResult("2", "Java", "query", []*wrappers.ScanResultNode{
+				createRedundancyTestNode("file.java", 10, 5),
+				createRedundancyTestNode("file.java", 20, 10),
+				createRedundancyTestNode("file.java", 30, 15),
+				createRedundancyTestNode("file.java", 40, 20),
+			}),
+		}
+		subFlows := map[string]*SubFlow{
+			"sha1": {
+				ShaOne: "sha1",
+				Flow:   []string{"file.java:10:5", "file.java:20:10"},
+				Results: map[string]bool{
+					"1": true,
+					"2": true,
+				},
+			},
+		}
+
+		redundant := computeRedundantResults(subFlows, results)
+
+		assert.Len(t, redundant, 2)
+		// Result 1 has 100% coverage, so result 2 is redundant to it
+		assert.Len(t, redundant["1"], 0)
+		assert.True(t, redundant["2"]["1"])
+	})
+
+	t.Run("Low coverage skipped", func(t *testing.T) {
+		// Both results have 4 nodes, subflow has 1 node
+		// Coverage = 1/4 = 0.25 (below 0.5 threshold)
+		results := []*wrappers.ScanResult{
+			createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
+				createRedundancyTestNode("file.java", 10, 5),
+				createRedundancyTestNode("file.java", 20, 10),
+				createRedundancyTestNode("file.java", 30, 15),
+				createRedundancyTestNode("file.java", 40, 20),
+			}),
+			createRedundancyTestResult("2", "Java", "query", []*wrappers.ScanResultNode{
+				createRedundancyTestNode("file.java", 10, 5),
+				createRedundancyTestNode("file.java", 50, 25),
+				createRedundancyTestNode("file.java", 60, 30),
+				createRedundancyTestNode("file.java", 70, 35),
+			}),
+		}
+		subFlows := map[string]*SubFlow{
+			"sha1": {
+				ShaOne:  "sha1",
+				Flow:    []string{"file.java:10:5"},
+				Results: map[string]bool{"1": true, "2": true},
+			},
+		}
+
+		redundant := computeRedundantResults(subFlows, results)
+
+		// Both should have empty redundancy since coverage < 0.5
+		assert.Len(t, redundant["1"], 0)
+		assert.Len(t, redundant["2"], 0)
+	})
+}
+
+// TestComputeRedundantSastResultsForQuery tests the full query flow
+func TestComputeRedundantSastResultsForQuery(t *testing.T) {
+	t.Run("Empty results returns unchanged", func(t *testing.T) {
+		results := &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}}
+		result := ComputeRedundantSastResultsForQuery(results, "Java", "query")
+		assert.Equal(t, results, result)
+	})
+
+	t.Run("No matching query returns unchanged", func(t *testing.T) {
+		results := &wrappers.ScanResultsCollection{
+			Results: []*wrappers.ScanResult{
+				createRedundancyTestResult("1", "Java", "OtherQuery", nil),
+			},
+		}
+		result := ComputeRedundantSastResultsForQuery(results, "Java", "SQL_Injection")
+		assert.Equal(t, results, result)
+	})
+}
+
+// TestComputeRedundantSastResults tests the main entry point
+func TestComputeRedundantSastResults(t *testing.T) {
+	t.Run("Empty results", func(t *testing.T) {
+		results := &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}}
+		result := ComputeRedundantSastResults(results)
+		assert.NotNil(t, result)
+		assert.Len(t, result.Results, 0)
+	})
+
+	t.Run("Single result without redundancy", func(t *testing.T) {
+		results := &wrappers.ScanResultsCollection{
+			Results: []*wrappers.ScanResult{
+				createRedundancyTestResult("1", "Java", "SQL_Injection", []*wrappers.ScanResultNode{
+					createRedundancyTestNode("file.java", 10, 5),
+				}),
+			},
+		}
+		result := ComputeRedundantSastResults(results)
+		assert.NotNil(t, result)
+		assert.Len(t, result.Results, 1)
+	})
+
+	t.Run("Multiple languages processed", func(t *testing.T) {
+		results := &wrappers.ScanResultsCollection{
+			Results: []*wrappers.ScanResult{
+				createRedundancyTestResult("1", "Java", "SQL_Injection", []*wrappers.ScanResultNode{
+					createRedundancyTestNode("file.java", 10, 5),
+				}),
+				createRedundancyTestResult("2", "Python", "SQL_Injection", []*wrappers.ScanResultNode{
+					createRedundancyTestNode("file.py", 20, 10),
+				}),
+			},
+		}
+		result := ComputeRedundantSastResults(results)
+		assert.NotNil(t, result)
+		assert.Len(t, result.Results, 2)
+	})
+}

From 64ca5804fc62ffa5e7814ab2af0026869a98a390 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Fri, 30 Jan 2026 15:36:17 +0530
Subject: [PATCH 09/17] Add comprehensive tests for ContainerManager and
 related functions

- Implement tests for the real ContainerManager, including ID generation and command creation.
- Ensure unique container IDs and validate UUID format in tests.
- Add tests for createCommandWithEnhancedPath to verify argument passing and environment variable settings.
- Enhance tests for getFallbackPaths to check for duplicates and correct primary path ordering.
- Introduce additional tests for verifyEnginePath and engineNameResolution functions to cover edge cases.
- Expand tests for buildIgnoreMap and filterIgnoredFindings to ensure correct behavior with various inputs.
---
 internal/commands/results-redundancy_test.go  | 942 ------------------
 .../iacrealtime/container-manager_test.go     | 188 ++++
 .../iacrealtime/iac-realtime_test.go          | 347 +++++++
 3 files changed, 535 insertions(+), 942 deletions(-)
 delete mode 100644 internal/commands/results-redundancy_test.go

diff --git a/internal/commands/results-redundancy_test.go b/internal/commands/results-redundancy_test.go
deleted file mode 100644
index adf57549d..000000000
--- a/internal/commands/results-redundancy_test.go
+++ /dev/null
@@ -1,942 +0,0 @@
-//go:build !integration
-
-package commands
-
-import (
-	"testing"
-
-	"github.com/checkmarx/ast-cli/internal/wrappers"
-	"github.com/stretchr/testify/assert"
-)
-
-// Helper function to create a mock ScanResult with nodes for redundancy tests
-func createRedundancyTestResult(id, language, queryName string, nodes []*wrappers.ScanResultNode) *wrappers.ScanResult {
-	return &wrappers.ScanResult{
-		ID: id,
-		ScanResultData: wrappers.ScanResultData{
-			LanguageName: language,
-			QueryName:    queryName,
-			Nodes:        nodes,
-		},
-	}
-}
-
-// Helper function to create a mock ScanResultNode for redundancy tests
-func createRedundancyTestNode(fileName string, line, column uint) *wrappers.ScanResultNode {
-	return &wrappers.ScanResultNode{
-		FileName: fileName,
-		Line:     line,
-		Column:   column,
-	}
-}
-
-// TestGetLanguages tests the GetLanguages function
-func TestGetLanguages(t *testing.T) {
-	tests := []struct {
-		name     string
-		results  *wrappers.ScanResultsCollection
-		expected map[string]bool
-	}{
-		{
-			name:     "Empty results",
-			results:  &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}},
-			expected: map[string]bool{},
-		},
-		{
-			name: "Single language",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "query1", nil),
-				},
-			},
-			expected: map[string]bool{"Java": true},
-		},
-		{
-			name: "Multiple languages",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "query1", nil),
-					createRedundancyTestResult("2", "Python", "query2", nil),
-					createRedundancyTestResult("3", "JavaScript", "query3", nil),
-				},
-			},
-			expected: map[string]bool{"Java": true, "Python": true, "JavaScript": true},
-		},
-		{
-			name: "Duplicate languages",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "query1", nil),
-					createRedundancyTestResult("2", "Java", "query2", nil),
-					createRedundancyTestResult("3", "Python", "query3", nil),
-				},
-			},
-			expected: map[string]bool{"Java": true, "Python": true},
-		},
-		{
-			name: "Empty language name skipped",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "query1", nil),
-					createRedundancyTestResult("2", "", "query2", nil),
-				},
-			},
-			expected: map[string]bool{"Java": true},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := GetLanguages(tt.results)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestGetQueries tests the GetQueries function
-func TestGetQueries(t *testing.T) {
-	tests := []struct {
-		name      string
-		results   *wrappers.ScanResultsCollection
-		languages map[string]bool
-		expected  map[string]map[string]bool
-	}{
-		{
-			name:      "Empty results",
-			results:   &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}},
-			languages: map[string]bool{"Java": true},
-			expected:  map[string]map[string]bool{},
-		},
-		{
-			name: "Single language single query",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
-				},
-			},
-			languages: map[string]bool{"Java": true},
-			expected:  map[string]map[string]bool{"Java": {"SQL_Injection": true}},
-		},
-		{
-			name: "Multiple queries per language",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
-					createRedundancyTestResult("2", "Java", "XSS", nil),
-					createRedundancyTestResult("3", "Python", "Command_Injection", nil),
-				},
-			},
-			languages: map[string]bool{"Java": true, "Python": true},
-			expected: map[string]map[string]bool{
-				"Java":   {"SQL_Injection": true, "XSS": true},
-				"Python": {"Command_Injection": true},
-			},
-		},
-		{
-			name: "Language not in filter skipped",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
-					createRedundancyTestResult("2", "Ruby", "XSS", nil),
-				},
-			},
-			languages: map[string]bool{"Java": true},
-			expected:  map[string]map[string]bool{"Java": {"SQL_Injection": true}},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := GetQueries(tt.results, tt.languages)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestGetKey tests the GetKey function
-func TestGetKey(t *testing.T) {
-	tests := []struct {
-		name     string
-		r1       string
-		r2       string
-		expected string
-	}{
-		{
-			name:     "r1 less than r2",
-			r1:       "a",
-			r2:       "b",
-			expected: "a,b",
-		},
-		{
-			name:     "r2 less than r1",
-			r1:       "b",
-			r2:       "a",
-			expected: "a,b",
-		},
-		{
-			name:     "Same values",
-			r1:       "same",
-			r2:       "same",
-			expected: "same,same",
-		},
-		{
-			name:     "Numeric strings",
-			r1:       "123",
-			r2:       "456",
-			expected: "123,456",
-		},
-		{
-			name:     "Empty strings",
-			r1:       "",
-			r2:       "a",
-			expected: ",a",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := GetKey(tt.r1, tt.r2)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestRoundFloat tests the roundFloat function
-func TestRoundFloat(t *testing.T) {
-	tests := []struct {
-		name      string
-		val       float64
-		precision uint
-		expected  float64
-	}{
-		{
-			name:      "Round down",
-			val:       1.234,
-			precision: 2,
-			expected:  1.23,
-		},
-		{
-			name:      "Round up",
-			val:       1.235,
-			precision: 2,
-			expected:  1.24,
-		},
-		{
-			name:      "No decimal places",
-			val:       1.5,
-			precision: 0,
-			expected:  2.0,
-		},
-		{
-			name:      "Already rounded",
-			val:       1.0,
-			precision: 2,
-			expected:  1.0,
-		},
-		{
-			name:      "High precision",
-			val:       1.23456789,
-			precision: 4,
-			expected:  1.2346,
-		},
-		{
-			name:      "Zero value",
-			val:       0.0,
-			precision: 2,
-			expected:  0.0,
-		},
-		{
-			name:      "Negative value",
-			val:       -1.234,
-			precision: 2,
-			expected:  -1.23,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := roundFloat(tt.val, tt.precision)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestGetSha1String tests the getSha1String function
-func TestGetSha1String(t *testing.T) {
-	tests := []struct {
-		name  string
-		lines []string
-	}{
-		{
-			name:  "Single line",
-			lines: []string{"hello"},
-		},
-		{
-			name:  "Multiple lines",
-			lines: []string{"hello", "world"},
-		},
-		{
-			name:  "Empty slice",
-			lines: []string{},
-		},
-		{
-			name:  "Lines with special characters",
-			lines: []string{"file.go:10:5", "file.go:20:10"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := getSha1String(tt.lines)
-			assert.NotEmpty(t, result)
-			// Verify deterministic output
-			result2 := getSha1String(tt.lines)
-			assert.Equal(t, result, result2)
-			// SHA1 produces 40 character hex string
-			assert.Len(t, result, 40)
-		})
-	}
-
-	// Test that different inputs produce different outputs
-	t.Run("Different inputs produce different outputs", func(t *testing.T) {
-		result1 := getSha1String([]string{"a", "b"})
-		result2 := getSha1String([]string{"c", "d"})
-		assert.NotEqual(t, result1, result2)
-	})
-}
-
-// TestGetResultsForQuery tests the GetResultsForQuery function
-func TestGetResultsForQuery(t *testing.T) {
-	tests := []struct {
-		name        string
-		results     *wrappers.ScanResultsCollection
-		language    string
-		query       string
-		expectedLen int
-		expectedIDs []string
-	}{
-		{
-			name:        "Empty results",
-			results:     &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}},
-			language:    "Java",
-			query:       "SQL_Injection",
-			expectedLen: 0,
-			expectedIDs: nil,
-		},
-		{
-			name: "Single matching result",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
-				},
-			},
-			language:    "Java",
-			query:       "SQL_Injection",
-			expectedLen: 1,
-			expectedIDs: []string{"1"},
-		},
-		{
-			name: "Multiple matching results sorted by ID",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("3", "Java", "SQL_Injection", nil),
-					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
-					createRedundancyTestResult("2", "Java", "SQL_Injection", nil),
-				},
-			},
-			language:    "Java",
-			query:       "SQL_Injection",
-			expectedLen: 3,
-			expectedIDs: []string{"1", "2", "3"},
-		},
-		{
-			name: "Filter by language",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
-					createRedundancyTestResult("2", "Python", "SQL_Injection", nil),
-				},
-			},
-			language:    "Java",
-			query:       "SQL_Injection",
-			expectedLen: 1,
-			expectedIDs: []string{"1"},
-		},
-		{
-			name: "Filter by query",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "SQL_Injection", nil),
-					createRedundancyTestResult("2", "Java", "XSS", nil),
-				},
-			},
-			language:    "Java",
-			query:       "SQL_Injection",
-			expectedLen: 1,
-			expectedIDs: []string{"1"},
-		},
-		{
-			name: "No matching results",
-			results: &wrappers.ScanResultsCollection{
-				Results: []*wrappers.ScanResult{
-					createRedundancyTestResult("1", "Java", "XSS", nil),
-				},
-			},
-			language:    "Java",
-			query:       "SQL_Injection",
-			expectedLen: 0,
-			expectedIDs: nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := GetResultsForQuery(tt.results, tt.language, tt.query)
-			assert.Len(t, result, tt.expectedLen)
-			if tt.expectedIDs != nil {
-				for i, expectedID := range tt.expectedIDs {
-					assert.Equal(t, expectedID, result[i].ID)
-				}
-			}
-		})
-	}
-}
-
-// TestGetResultForID tests the getResultForID function
-func TestGetResultForID(t *testing.T) {
-	results := []*wrappers.ScanResult{
-		createRedundancyTestResult("1", "Java", "query1", nil),
-		createRedundancyTestResult("2", "Python", "query2", nil),
-		createRedundancyTestResult("3", "JavaScript", "query3", nil),
-	}
-
-	tests := []struct {
-		name     string
-		resultID string
-		expected *wrappers.ScanResult
-	}{
-		{
-			name:     "Find existing result",
-			resultID: "2",
-			expected: results[1],
-		},
-		{
-			name:     "Result not found",
-			resultID: "999",
-			expected: nil,
-		},
-		{
-			name:     "Empty ID",
-			resultID: "",
-			expected: nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := getResultForID(results, tt.resultID)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-// TestBuildFlows tests the buildFlows function
-func TestBuildFlows(t *testing.T) {
-	tests := []struct {
-		name         string
-		queryResults []*wrappers.ScanResult
-		expectedKeys []string
-	}{
-		{
-			name:         "Empty results",
-			queryResults: []*wrappers.ScanResult{},
-			expectedKeys: []string{},
-		},
-		{
-			name: "Single result with nodes",
-			queryResults: []*wrappers.ScanResult{
-				createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
-					createRedundancyTestNode("file.java", 10, 5),
-					createRedundancyTestNode("file.java", 20, 10),
-				}),
-			},
-			expectedKeys: []string{"1"},
-		},
-		{
-			name: "Multiple results",
-			queryResults: []*wrappers.ScanResult{
-				createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
-					createRedundancyTestNode("file.java", 10, 5),
-				}),
-				createRedundancyTestResult("2", "Java", "query", []*wrappers.ScanResultNode{
-					createRedundancyTestNode("file.java", 20, 10),
-				}),
-			},
-			expectedKeys: []string{"1", "2"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := buildFlows(tt.queryResults)
-			assert.Len(t, result, len(tt.expectedKeys))
-			for _, key := range tt.expectedKeys {
-				_, exists := result[key]
-				assert.True(t, exists, "Expected key %s to exist", key)
-			}
-		})
-	}
-}
-
-// TestBuildFlows_NodeFormat tests that buildFlows creates correct node string format
-func TestBuildFlows_NodeFormat(t *testing.T) {
-	queryResults := []*wrappers.ScanResult{
-		createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
-			createRedundancyTestNode("file.java", 10, 5),
-			createRedundancyTestNode("file.java", 20, 10),
-		}),
-	}
-
-	result := buildFlows(queryResults)
-	flows := result["1"]
-
-	assert.Len(t, flows, 2)
-	assert.Equal(t, "file.java:10:5", flows[0])
-	assert.Equal(t, "file.java:20:10", flows[1])
-}
-
-// TestSortSubFlowIDs tests the sortSubFlowIDs function
-func TestSortSubFlowIDs(t *testing.T) {
-	tests := []struct {
-		name     string
-		subFlows map[string]*SubFlow
-		expected []string
-	}{
-		{
-			name:     "Empty map",
-			subFlows: map[string]*SubFlow{},
-			expected: nil,
-		},
-		{
-			name: "Single subflow",
-			subFlows: map[string]*SubFlow{
-				"abc": {ShaOne: "abc"},
-			},
-			expected: []string{"abc"},
-		},
-		{
-			name: "Multiple subflows sorted",
-			subFlows: map[string]*SubFlow{
-				"zzz": {ShaOne: "zzz"},
-				"aaa": {ShaOne: "aaa"},
-				"mmm": {ShaOne: "mmm"},
-			},
-			expected: []string{"aaa", "mmm", "zzz"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := sortSubFlowIDs(tt.subFlows)
-			if tt.expected == nil {
-				assert.Nil(t, result)
-			} else {
-				assert.Equal(t, tt.expected, result)
-			}
-		})
-	}
-}
-
-// TestSortSubFlowResultIDs tests the sortSubFlowResultIDs function
-func TestSortSubFlowResultIDs(t *testing.T) {
-	tests := []struct {
-		name     string
-		subFlow  *SubFlow
-		expected []string
-	}{
-		{
-			name: "Empty results",
-			subFlow: &SubFlow{
-				Results: map[string]bool{},
-			},
-			expected: nil,
-		},
-		{
-			name: "Single result",
-			subFlow: &SubFlow{
-				Results: map[string]bool{"1": true},
-			},
-			expected: []string{"1"},
-		},
-		{
-			name: "Multiple results sorted",
-			subFlow: &SubFlow{
-				Results: map[string]bool{
-					"3": true,
-					"1": true,
-					"2": true,
-				},
-			},
-			expected: []string{"1", "2", "3"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := sortSubFlowResultIDs(tt.subFlow)
-			if tt.expected == nil {
-				assert.Nil(t, result)
-			} else {
-				assert.Equal(t, tt.expected, result)
-			}
-		})
-	}
-}
-
-// TestGetMaxCoverage tests the getMaxCoverage function
-func TestGetMaxCoverage(t *testing.T) {
-	tests := []struct {
-		name                string
-		coverage            map[string]float64
-		expectedID          string
-		expectedMaxCoverage float64
-	}{
-		{
-			name:                "Empty coverage",
-			coverage:            map[string]float64{},
-			expectedID:          "",
-			expectedMaxCoverage: 0.0,
-		},
-		{
-			name:                "Single entry",
-			coverage:            map[string]float64{"1": 0.75},
-			expectedID:          "1",
-			expectedMaxCoverage: 0.75,
-		},
-		{
-			name:                "Multiple entries",
-			coverage:            map[string]float64{"1": 0.5, "2": 0.8, "3": 0.6},
-			expectedID:          "2",
-			expectedMaxCoverage: 0.8,
-		},
-		{
-			name:                "Tie goes to lexically first",
-			coverage:            map[string]float64{"b": 0.5, "a": 0.5},
-			expectedID:          "a",
-			expectedMaxCoverage: 0.5,
-		},
-		{
-			name:                "All zero coverage",
-			coverage:            map[string]float64{"1": 0.0, "2": 0.0},
-			expectedID:          "",
-			expectedMaxCoverage: 0.0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			resultID, maxCov := getMaxCoverage(tt.coverage)
-			assert.Equal(t, tt.expectedID, resultID)
-			assert.Equal(t, tt.expectedMaxCoverage, maxCov)
-		})
-	}
-}
-
-// TestComputeSubFlow tests the computeSubFlow function
-func TestComputeSubFlow(t *testing.T) {
-	tests := []struct {
-		name         string
-		f1           []string
-		f2           []string
-		expectExists bool
-		expectedFlow []string
-	}{
-		{
-			name:         "No common elements",
-			f1:           []string{"a", "b", "c"},
-			f2:           []string{"d", "e", "f"},
-			expectExists: false,
-			expectedFlow: nil,
-		},
-		{
-			name:         "Exact match",
-			f1:           []string{"a", "b", "c"},
-			f2:           []string{"a", "b", "c"},
-			expectExists: true,
-			expectedFlow: []string{"a", "b", "c"},
-		},
-		{
-			name:         "Partial match at start",
-			f1:           []string{"a", "b", "c"},
-			f2:           []string{"a", "b", "d"},
-			expectExists: true,
-			expectedFlow: []string{"a", "b"},
-		},
-		{
-			name:         "Common subsequence in middle",
-			f1:           []string{"x", "a", "b", "y"},
-			f2:           []string{"z", "a", "b", "w"},
-			expectExists: true,
-			expectedFlow: []string{"a", "b"},
-		},
-		{
-			name:         "Single common element",
-			f1:           []string{"a", "b", "c"},
-			f2:           []string{"x", "a", "y"},
-			expectExists: true,
-			expectedFlow: []string{"a"},
-		},
-		{
-			name:         "Empty first flow",
-			f1:           []string{},
-			f2:           []string{"a", "b"},
-			expectExists: false,
-			expectedFlow: nil,
-		},
-		{
-			name:         "Empty second flow",
-			f1:           []string{"a", "b"},
-			f2:           []string{},
-			expectExists: false,
-			expectedFlow: nil,
-		},
-		{
-			name:         "Both flows empty",
-			f1:           []string{},
-			f2:           []string{},
-			expectExists: false,
-			expectedFlow: nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			exists, subFlow := computeSubFlow(tt.f1, tt.f2)
-			assert.Equal(t, tt.expectExists, exists)
-			if tt.expectExists {
-				assert.NotNil(t, subFlow)
-				assert.Equal(t, tt.expectedFlow, subFlow.Flow)
-				assert.NotEmpty(t, subFlow.ShaOne)
-			} else {
-				assert.Nil(t, subFlow)
-			}
-		})
-	}
-}
-
-// TestCompareFlows tests the compareFlows function
-func TestCompareFlows(t *testing.T) {
-	tests := []struct {
-		name     string
-		flows    map[string][]string
-		expected int // number of subflows expected
-	}{
-		{
-			name:     "Empty flows",
-			flows:    map[string][]string{},
-			expected: 0,
-		},
-		{
-			name: "Single flow",
-			flows: map[string][]string{
-				"1": {"a", "b", "c"},
-			},
-			expected: 0,
-		},
-		{
-			name: "Two flows with common subflow",
-			flows: map[string][]string{
-				"1": {"a", "b", "c"},
-				"2": {"a", "b", "d"},
-			},
-			expected: 1,
-		},
-		{
-			name: "Two flows with no common subflow",
-			flows: map[string][]string{
-				"1": {"a", "b", "c"},
-				"2": {"d", "e", "f"},
-			},
-			expected: 0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := compareFlows(tt.flows)
-			assert.Len(t, result, tt.expected)
-		})
-	}
-}
-
-// TestLabelRedundantResults tests the labelRedundantResults function
-func TestLabelRedundantResults(t *testing.T) {
-	t.Run("Labels fix for results with no redundant entries", func(t *testing.T) {
-		results := []*wrappers.ScanResult{
-			createRedundancyTestResult("1", "Java", "query", nil),
-		}
-		redundantResults := map[string]map[string]bool{
-			"1": {}, // Empty map means no redundancy
-		}
-		labelRedundantResults(results, redundantResults)
-		assert.Equal(t, "fix", results[0].ScanResultData.Redundancy)
-	})
-
-	t.Run("Labels redundant for results with redundant entries", func(t *testing.T) {
-		results := []*wrappers.ScanResult{
-			createRedundancyTestResult("1", "Java", "query", nil),
-			createRedundancyTestResult("2", "Java", "query", nil),
-		}
-		redundantResults := map[string]map[string]bool{
-			"1": {},          // This is the fix
-			"2": {"1": true}, // This is redundant to 1
-		}
-		labelRedundantResults(results, redundantResults)
-		assert.Equal(t, "fix", results[0].ScanResultData.Redundancy)
-		assert.Equal(t, "redundant", results[1].ScanResultData.Redundancy)
-	})
-}
-
-// TestComputeRedundantResults tests the computeRedundantResults function
-func TestComputeRedundantResults(t *testing.T) {
-	t.Run("Empty subflows returns all empty redundant maps", func(t *testing.T) {
-		results := []*wrappers.ScanResult{
-			createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
-				createRedundancyTestNode("file.java", 10, 5),
-			}),
-		}
-		subFlows := map[string]*SubFlow{}
-
-		redundant := computeRedundantResults(subFlows, results)
-
-		assert.Len(t, redundant, 1)
-		assert.Len(t, redundant["1"], 0)
-	})
-
-	t.Run("High coverage marks redundancy", func(t *testing.T) {
-		// Result 1 has 2 nodes, Result 2 has 4 nodes
-		// Subflow has 2 nodes
-		// Coverage for 1 = 2/2 = 1.0 (100%)
-		// Coverage for 2 = 2/4 = 0.5 (50%)
-		// Since result 1 has higher coverage, result 2 is redundant to 1
-		results := []*wrappers.ScanResult{
-			createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
-				createRedundancyTestNode("file.java", 10, 5),
-				createRedundancyTestNode("file.java", 20, 10),
-			}),
-			createRedundancyTestResult("2", "Java", "query", []*wrappers.ScanResultNode{
-				createRedundancyTestNode("file.java", 10, 5),
-				createRedundancyTestNode("file.java", 20, 10),
-				createRedundancyTestNode("file.java", 30, 15),
-				createRedundancyTestNode("file.java", 40, 20),
-			}),
-		}
-		subFlows := map[string]*SubFlow{
-			"sha1": {
-				ShaOne: "sha1",
-				Flow:   []string{"file.java:10:5", "file.java:20:10"},
-				Results: map[string]bool{
-					"1": true,
-					"2": true,
-				},
-			},
-		}
-
-		redundant := computeRedundantResults(subFlows, results)
-
-		assert.Len(t, redundant, 2)
-		// Result 1 has 100% coverage, so result 2 is redundant to it
-		assert.Len(t, redundant["1"], 0)
-		assert.True(t, redundant["2"]["1"])
-	})
-
-	t.Run("Low coverage skipped", func(t *testing.T) {
-		// Both results have 4 nodes, subflow has 1 node
-		// Coverage = 1/4 = 0.25 (below 0.5 threshold)
-		results := []*wrappers.ScanResult{
-			createRedundancyTestResult("1", "Java", "query", []*wrappers.ScanResultNode{
-				createRedundancyTestNode("file.java", 10, 5),
-				createRedundancyTestNode("file.java", 20, 10),
-				createRedundancyTestNode("file.java", 30, 15),
-				createRedundancyTestNode("file.java", 40, 20),
-			}),
-			createRedundancyTestResult("2", "Java", "query", []*wrappers.ScanResultNode{
-				createRedundancyTestNode("file.java", 10, 5),
-				createRedundancyTestNode("file.java", 50, 25),
-				createRedundancyTestNode("file.java", 60, 30),
-				createRedundancyTestNode("file.java", 70, 35),
-			}),
-		}
-		subFlows := map[string]*SubFlow{
-			"sha1": {
-				ShaOne:  "sha1",
-				Flow:    []string{"file.java:10:5"},
-				Results: map[string]bool{"1": true, "2": true},
-			},
-		}
-
-		redundant := computeRedundantResults(subFlows, results)
-
-		// Both should have empty redundancy since coverage < 0.5
-		assert.Len(t, redundant["1"], 0)
-		assert.Len(t, redundant["2"], 0)
-	})
-}
-
-// TestComputeRedundantSastResultsForQuery tests the full query flow
-func TestComputeRedundantSastResultsForQuery(t *testing.T) {
-	t.Run("Empty results returns unchanged", func(t *testing.T) {
-		results := &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}}
-		result := ComputeRedundantSastResultsForQuery(results, "Java", "query")
-		assert.Equal(t, results, result)
-	})
-
-	t.Run("No matching query returns unchanged", func(t *testing.T) {
-		results := &wrappers.ScanResultsCollection{
-			Results: []*wrappers.ScanResult{
-				createRedundancyTestResult("1", "Java", "OtherQuery", nil),
-			},
-		}
-		result := ComputeRedundantSastResultsForQuery(results, "Java", "SQL_Injection")
-		assert.Equal(t, results, result)
-	})
-}
-
-// TestComputeRedundantSastResults tests the main entry point
-func TestComputeRedundantSastResults(t *testing.T) {
-	t.Run("Empty results", func(t *testing.T) {
-		results := &wrappers.ScanResultsCollection{Results: []*wrappers.ScanResult{}}
-		result := ComputeRedundantSastResults(results)
-		assert.NotNil(t, result)
-		assert.Len(t, result.Results, 0)
-	})
-
-	t.Run("Single result without redundancy", func(t *testing.T) {
-		results := &wrappers.ScanResultsCollection{
-			Results: []*wrappers.ScanResult{
-				createRedundancyTestResult("1", "Java", "SQL_Injection", []*wrappers.ScanResultNode{
-					createRedundancyTestNode("file.java", 10, 5),
-				}),
-			},
-		}
-		result := ComputeRedundantSastResults(results)
-		assert.NotNil(t, result)
-		assert.Len(t, result.Results, 1)
-	})
-
-	t.Run("Multiple languages processed", func(t *testing.T) {
-		results := &wrappers.ScanResultsCollection{
-			Results: []*wrappers.ScanResult{
-				createRedundancyTestResult("1", "Java", "SQL_Injection", []*wrappers.ScanResultNode{
-					createRedundancyTestNode("file.java", 10, 5),
-				}),
-				createRedundancyTestResult("2", "Python", "SQL_Injection", []*wrappers.ScanResultNode{
-					createRedundancyTestNode("file.py", 20, 10),
-				}),
-			},
-		}
-		result := ComputeRedundantSastResults(results)
-		assert.NotNil(t, result)
-		assert.Len(t, result.Results, 2)
-	})
-}
diff --git a/internal/services/realtimeengine/iacrealtime/container-manager_test.go b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
index 54b966b7f..4ff6f6db1 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager_test.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
@@ -356,3 +356,191 @@ func TestMockContainerManager_EnsureImageAvailable_CustomError(t *testing.T) {
 		t.Error("EnsureImageAvailable should return custom error when set")
 	}
 }
+
+// ============================================================================
+// Tests for REAL ContainerManager implementation (not mock)
+// ============================================================================
+
+func TestNewContainerManager(t *testing.T) {
+	cm := NewContainerManager()
+
+	if cm == nil {
+		t.Fatal("NewContainerManager() should not return nil")
+	}
+
+	// Verify it implements the interface
+	var _ IContainerManager = cm
+}
+
+func TestContainerManager_GenerateContainerID(t *testing.T) {
+	cm := &ContainerManager{}
+
+	// Clear any existing value
+	viper.Set(commonParams.KicsContainerNameKey, "")
+
+	containerName := cm.GenerateContainerID()
+
+	// Test that a container name was generated
+	if containerName == "" {
+		t.Error("GenerateContainerID() should return a non-empty container name")
+	}
+
+	// Test that it has the correct prefix
+	if !strings.HasPrefix(containerName, KicsContainerPrefix) {
+		t.Errorf("Container name should start with prefix '%s', got '%s'", KicsContainerPrefix, containerName)
+	}
+
+	// Test that the UUID part exists (should be longer than just the prefix)
+	if len(containerName) <= len(KicsContainerPrefix) {
+		t.Error("Container name should include UUID after prefix")
+	}
+
+	// Test that viper was set correctly
+	viperValue := viper.GetString(commonParams.KicsContainerNameKey)
+	if viperValue != containerName {
+		t.Errorf("Viper should be set to '%s', got '%s'", containerName, viperValue)
+	}
+
+	// Test that subsequent calls generate different IDs
+	containerName2 := cm.GenerateContainerID()
+	if containerName == containerName2 {
+		t.Error("GenerateContainerID() should generate unique container names")
+	}
+}
+
+func TestContainerManager_GenerateContainerID_UUIDFormat(t *testing.T) {
+	cm := &ContainerManager{}
+
+	containerName := cm.GenerateContainerID()
+
+	// Extract UUID part (after prefix)
+	uuidPart := strings.TrimPrefix(containerName, KicsContainerPrefix)
+
+	// UUID should be 36 characters (8-4-4-4-12 format with hyphens)
+	if len(uuidPart) != 36 {
+		t.Errorf("UUID part should be 36 characters, got %d: %s", len(uuidPart), uuidPart)
+	}
+
+	// Verify UUID format (contains hyphens at correct positions)
+	if uuidPart[8] != '-' || uuidPart[13] != '-' || uuidPart[18] != '-' || uuidPart[23] != '-' {
+		t.Errorf("UUID part should have hyphens at positions 8,13,18,23: %s", uuidPart)
+	}
+}
+
+// ============================================================================
+// Tests for createCommandWithEnhancedPath function
+// ============================================================================
+
+func TestCreateCommandWithEnhancedPath_ArgsPassedCorrectly(t *testing.T) {
+	tests := []struct {
+		name         string
+		enginePath   string
+		args         []string
+		expectedArgs []string
+	}{
+		{
+			name:         "Multiple args",
+			enginePath:   "/usr/bin/docker",
+			args:         []string{"run", "--rm", "-v", "/tmp:/data", "hello-world"},
+			expectedArgs: []string{"/usr/bin/docker", "run", "--rm", "-v", "/tmp:/data", "hello-world"},
+		},
+		{
+			name:         "Single arg",
+			enginePath:   "/usr/bin/docker",
+			args:         []string{"--version"},
+			expectedArgs: []string{"/usr/bin/docker", "--version"},
+		},
+		{
+			name:         "No args",
+			enginePath:   "/usr/bin/podman",
+			args:         []string{},
+			expectedArgs: []string{"/usr/bin/podman"},
+		},
+		{
+			name:         "Args with special characters",
+			enginePath:   "/usr/local/bin/docker",
+			args:         []string{"run", "--env", "VAR=value with spaces"},
+			expectedArgs: []string{"/usr/local/bin/docker", "run", "--env", "VAR=value with spaces"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := createCommandWithEnhancedPath(tt.enginePath, tt.args...)
+
+			if cmd == nil {
+				t.Fatal("createCommandWithEnhancedPath should not return nil")
+			}
+
+			if len(cmd.Args) != len(tt.expectedArgs) {
+				t.Errorf("Expected %d args, got %d", len(tt.expectedArgs), len(cmd.Args))
+			}
+
+			for i, expected := range tt.expectedArgs {
+				if i < len(cmd.Args) && cmd.Args[i] != expected {
+					t.Errorf("Arg[%d]: expected %q, got %q", i, expected, cmd.Args[i])
+				}
+			}
+		})
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_CommandPath(t *testing.T) {
+	tests := []struct {
+		name       string
+		enginePath string
+	}{
+		{
+			name:       "Absolute path",
+			enginePath: "/usr/bin/docker",
+		},
+		{
+			name:       "Relative path",
+			enginePath: "./docker",
+		},
+		{
+			name:       "Just command name",
+			enginePath: "docker",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := createCommandWithEnhancedPath(tt.enginePath, "--version")
+
+			if cmd == nil {
+				t.Fatal("createCommandWithEnhancedPath should not return nil")
+			}
+
+			// The first arg should always be the engine path
+			if len(cmd.Args) < 1 || cmd.Args[0] != tt.enginePath {
+				t.Errorf("First arg should be engine path %q, got %v", tt.enginePath, cmd.Args)
+			}
+		})
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_EnvIsSet(t *testing.T) {
+	cmd := createCommandWithEnhancedPath("/usr/bin/docker", "run")
+
+	// On non-macOS, Env might be nil (uses parent env)
+	// On macOS, Env should be set with enhanced PATH
+	// This test verifies the command is created without error
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	// If Env is set, verify PATH is present
+	if cmd.Env != nil {
+		foundPath := false
+		for _, e := range cmd.Env {
+			if strings.HasPrefix(e, "PATH=") {
+				foundPath = true
+				break
+			}
+		}
+		if !foundPath {
+			t.Error("If Env is set, it should contain PATH")
+		}
+	}
+}
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
index 53f5177be..894c981a4 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 
 	commonParams "github.com/checkmarx/ast-cli/internal/params"
@@ -732,3 +733,349 @@ func TestGetFallbackPaths_Windows(t *testing.T) {
 		t.Errorf("Expected %s, got %s", expectedPrimary, paths[0])
 	}
 }
+
+// ============================================================================
+// Additional tests for getFallbackPaths function
+// ============================================================================
+
+func TestGetFallbackPaths_NoDuplicates(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	// Use /usr/local/bin as fallback dir (same as one of macOSDockerFallbackPaths)
+	fallbackDir := "/usr/local/bin"
+	paths := getFallbackPaths(engineDocker, fallbackDir)
+
+	// Check for duplicates
+	seen := make(map[string]bool)
+	for _, p := range paths {
+		if seen[p] {
+			t.Errorf("Duplicate path found: %s", p)
+		}
+		seen[p] = true
+	}
+}
+
+func TestGetFallbackPaths_PrimaryPathFirst(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	fallbackDir := "/custom/fallback"
+	paths := getFallbackPaths(engineDocker, fallbackDir)
+
+	if len(paths) == 0 {
+		t.Fatal("Expected at least one path")
+	}
+
+	expectedPrimary := filepath.Join(fallbackDir, engineDocker)
+	if paths[0] != expectedPrimary {
+		t.Errorf("Primary fallback path should be first. Expected %s, got %s", expectedPrimary, paths[0])
+	}
+}
+
+func TestGetFallbackPaths_EmptyFallbackDir(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return "linux" }
+
+	paths := getFallbackPaths(engineDocker, "")
+
+	if len(paths) != 1 {
+		t.Errorf("Expected 1 path with empty fallback dir, got %d", len(paths))
+	}
+
+	// Should just be the engine name
+	if paths[0] != engineDocker {
+		t.Errorf("Expected %s, got %s", engineDocker, paths[0])
+	}
+}
+
+// ============================================================================
+// Additional tests for verifyEnginePath function
+// ============================================================================
+
+func TestVerifyEnginePath_EmptyPath(t *testing.T) {
+	result := verifyEnginePath("")
+	if result {
+		t.Error("verifyEnginePath should return false for empty path")
+	}
+}
+
+func TestVerifyEnginePath_FileWithoutExecutePermission(t *testing.T) {
+	if runtime.GOOS == osWindows {
+		t.Skip("Skipping permission test on Windows")
+	}
+
+	tempDir := t.TempDir()
+	testFile := filepath.Join(tempDir, "non-executable")
+
+	// Create file without execute permission
+	err := os.WriteFile(testFile, []byte("not executable"), 0644)
+	if err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	result := verifyEnginePath(testFile)
+	if result {
+		t.Error("verifyEnginePath should return false for non-executable file")
+	}
+}
+
+func TestVerifyEnginePath_SymlinkToNonExistent(t *testing.T) {
+	if runtime.GOOS == osWindows {
+		t.Skip("Skipping symlink test on Windows")
+	}
+
+	tempDir := t.TempDir()
+	symlinkPath := filepath.Join(tempDir, "broken-symlink")
+
+	// Create symlink to non-existent target
+	err := os.Symlink("/non/existent/target", symlinkPath)
+	if err != nil {
+		t.Skipf("Cannot create symlink: %v", err)
+	}
+
+	result := verifyEnginePath(symlinkPath)
+	if result {
+		t.Error("verifyEnginePath should return false for broken symlink")
+	}
+}
+
+// ============================================================================
+// Additional tests for engineNameResolution function
+// ============================================================================
+
+func TestEngineNameResolution_WindowsNotInPath(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osWindows }
+
+	// Save and clear PATH
+	oldPath := os.Getenv("PATH")
+	defer func() { _ = os.Setenv("PATH", oldPath) }()
+	_ = os.Setenv("PATH", "")
+
+	_, err := engineNameResolution("docker", "/fallback")
+
+	if err == nil {
+		t.Error("engineNameResolution should return error on Windows when engine not in PATH")
+	}
+
+	expectedMsg := "docker: executable file not found in PATH"
+	if err.Error() != expectedMsg {
+		t.Errorf("Expected error message %q, got %q", expectedMsg, err.Error())
+	}
+}
+
+func TestEngineNameResolution_FallbackPathsChecked(t *testing.T) {
+	if runtime.GOOS == osWindows {
+		t.Skip("Skipping fallback path test on Windows")
+	}
+
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return "linux" }
+
+	// Save and clear PATH
+	oldPath := os.Getenv("PATH")
+	defer func() { _ = os.Setenv("PATH", oldPath) }()
+	_ = os.Setenv("PATH", "")
+
+	// Use a non-existent fallback directory
+	_, err := engineNameResolution("docker", "/non/existent/path")
+
+	if err == nil {
+		t.Error("engineNameResolution should return error when engine not found")
+	}
+
+	// Error should mention fallback locations
+	if !strings.Contains(err.Error(), "fallback locations") {
+		t.Errorf("Error should mention fallback locations: %v", err)
+	}
+}
+
+func TestEngineNameResolution_EmptyEngineName(t *testing.T) {
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return "linux" }
+
+	// Save and clear PATH
+	oldPath := os.Getenv("PATH")
+	defer func() { _ = os.Setenv("PATH", oldPath) }()
+	_ = os.Setenv("PATH", "")
+
+	_, err := engineNameResolution("", "/fallback")
+
+	if err == nil {
+		t.Error("engineNameResolution should return error for empty engine name")
+	}
+}
+
+// ============================================================================
+// Tests for buildIgnoreMap function (direct tests)
+// ============================================================================
+
+func TestBuildIgnoreMap_Empty(t *testing.T) {
+	ignored := []IgnoredIacFinding{}
+	result := buildIgnoreMap(ignored)
+
+	if len(result) != 0 {
+		t.Errorf("Expected empty map, got %d entries", len(result))
+	}
+}
+
+func TestBuildIgnoreMap_SingleEntry(t *testing.T) {
+	ignored := []IgnoredIacFinding{
+		{
+			Title:        "Test Finding",
+			SimilarityID: "abc123",
+		},
+	}
+	result := buildIgnoreMap(ignored)
+
+	if len(result) != 1 {
+		t.Errorf("Expected 1 entry, got %d", len(result))
+	}
+
+	expectedKey := "Test Finding_abc123"
+	if !result[expectedKey] {
+		t.Errorf("Expected key %q to be true", expectedKey)
+	}
+}
+
+func TestBuildIgnoreMap_MultipleEntries(t *testing.T) {
+	ignored := []IgnoredIacFinding{
+		{Title: "Finding1", SimilarityID: "id1"},
+		{Title: "Finding2", SimilarityID: "id2"},
+		{Title: "Finding3", SimilarityID: "id3"},
+	}
+	result := buildIgnoreMap(ignored)
+
+	if len(result) != 3 {
+		t.Errorf("Expected 3 entries, got %d", len(result))
+	}
+
+	expectedKeys := []string{"Finding1_id1", "Finding2_id2", "Finding3_id3"}
+	for _, key := range expectedKeys {
+		if !result[key] {
+			t.Errorf("Expected key %q to be present", key)
+		}
+	}
+}
+
+func TestBuildIgnoreMap_DuplicateEntries(t *testing.T) {
+	ignored := []IgnoredIacFinding{
+		{Title: "Same", SimilarityID: "same"},
+		{Title: "Same", SimilarityID: "same"},
+	}
+	result := buildIgnoreMap(ignored)
+
+	// Duplicates should result in single entry
+	if len(result) != 1 {
+		t.Errorf("Expected 1 entry for duplicates, got %d", len(result))
+	}
+}
+
+// ============================================================================
+// Tests for filterIgnoredFindings function (additional cases)
+// ============================================================================
+
+func TestFilterIgnoredFindings_EmptyResults(t *testing.T) {
+	results := []IacRealtimeResult{}
+	ignoreMap := map[string]bool{"key": true}
+
+	filtered := filterIgnoredFindings(results, ignoreMap)
+
+	if len(filtered) != 0 {
+		t.Errorf("Expected empty result, got %d", len(filtered))
+	}
+}
+
+func TestFilterIgnoredFindings_EmptyIgnoreMap(t *testing.T) {
+	results := []IacRealtimeResult{
+		{Title: "Finding1", SimilarityID: "id1"},
+		{Title: "Finding2", SimilarityID: "id2"},
+	}
+	ignoreMap := map[string]bool{}
+
+	filtered := filterIgnoredFindings(results, ignoreMap)
+
+	if len(filtered) != 2 {
+		t.Errorf("Expected 2 results, got %d", len(filtered))
+	}
+}
+
+func TestFilterIgnoredFindings_AllIgnored(t *testing.T) {
+	results := []IacRealtimeResult{
+		{Title: "Finding1", SimilarityID: "id1"},
+		{Title: "Finding2", SimilarityID: "id2"},
+	}
+	ignoreMap := map[string]bool{
+		"Finding1_id1": true,
+		"Finding2_id2": true,
+	}
+
+	filtered := filterIgnoredFindings(results, ignoreMap)
+
+	if len(filtered) != 0 {
+		t.Errorf("Expected 0 results when all ignored, got %d", len(filtered))
+	}
+}
+
+func TestFilterIgnoredFindings_PartialMatch(t *testing.T) {
+	results := []IacRealtimeResult{
+		{Title: "Finding1", SimilarityID: "id1"},
+		{Title: "Finding2", SimilarityID: "id2"},
+		{Title: "Finding3", SimilarityID: "id3"},
+	}
+	ignoreMap := map[string]bool{
+		"Finding2_id2": true,
+	}
+
+	filtered := filterIgnoredFindings(results, ignoreMap)
+
+	if len(filtered) != 2 {
+		t.Errorf("Expected 2 results, got %d", len(filtered))
+	}
+
+	// Verify correct findings remain
+	titles := make(map[string]bool)
+	for _, r := range filtered {
+		titles[r.Title] = true
+	}
+
+	if !titles["Finding1"] || !titles["Finding3"] {
+		t.Error("Wrong findings were filtered")
+	}
+	if titles["Finding2"] {
+		t.Error("Finding2 should have been filtered out")
+	}
+}
+
+func TestFilterIgnoredFindings_PreservesOrder(t *testing.T) {
+	results := []IacRealtimeResult{
+		{Title: "A", SimilarityID: "1"},
+		{Title: "B", SimilarityID: "2"},
+		{Title: "C", SimilarityID: "3"},
+		{Title: "D", SimilarityID: "4"},
+	}
+	ignoreMap := map[string]bool{
+		"B_2": true,
+	}
+
+	filtered := filterIgnoredFindings(results, ignoreMap)
+
+	if len(filtered) != 3 {
+		t.Fatalf("Expected 3 results, got %d", len(filtered))
+	}
+
+	// Verify order is preserved
+	expectedOrder := []string{"A", "C", "D"}
+	for i, expected := range expectedOrder {
+		if filtered[i].Title != expected {
+			t.Errorf("Position %d: expected %s, got %s", i, expected, filtered[i].Title)
+		}
+	}
+}

From 2dbf5b4af3fe06f4668567fd9356b53a589fa852 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Fri, 30 Jan 2026 16:23:14 +0530
Subject: [PATCH 10/17] Enhance macOS support in createCommandWithEnhancedPath
 and add related tests

---
 .../realtimeengine/iacrealtime/constants.go   |   3 +
 .../iacrealtime/container-manager.go          |   3 +-
 .../iacrealtime/container-manager_test.go     | 132 +++++++++++++++++
 .../iacrealtime/iac-realtime_test.go          | 134 +++++++++++++++++-
 4 files changed, 266 insertions(+), 6 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/constants.go b/internal/services/realtimeengine/iacrealtime/constants.go
index 7209e813f..adb62200c 100644
--- a/internal/services/realtimeengine/iacrealtime/constants.go
+++ b/internal/services/realtimeengine/iacrealtime/constants.go
@@ -15,6 +15,9 @@ const (
 
 	// engineVerifyTimeout is the timeout in seconds for verifying container engine availability
 	engineVerifyTimeout = 5
+
+	// OS constants
+	osLinux = "linux"
 )
 
 // macOSDockerFallbackPaths contains additional paths to check for Docker on macOS
diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index 087369624..64aec66ac 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -4,7 +4,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"runtime"
 	"strings"
 
 	"github.com/checkmarx/ast-cli/internal/commands/util"
@@ -44,7 +43,7 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	cmd := exec.Command(enginePath, args...)
 
 	// Only enhance PATH on macOS
-	if runtime.GOOS != osDarwin {
+	if getOS() != osDarwin {
 		return cmd
 	}
 
diff --git a/internal/services/realtimeengine/iacrealtime/container-manager_test.go b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
index 4ff6f6db1..e71167e45 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager_test.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
@@ -1,7 +1,9 @@
 package iacrealtime
 
 import (
+	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -544,3 +546,133 @@ func TestCreateCommandWithEnhancedPath_EnvIsSet(t *testing.T) {
 		}
 	}
 }
+
+// ============================================================================
+// Tests for createCommandWithEnhancedPath on macOS (mocked)
+// ============================================================================
+
+func TestCreateCommandWithEnhancedPath_MacOS_EnhancesPath(t *testing.T) {
+	// Mock OS to be macOS
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	// Create a temp directory that exists (to be added to PATH)
+	tempDir := t.TempDir()
+	enginePath := filepath.Join(tempDir, "docker")
+
+	cmd := createCommandWithEnhancedPath(enginePath, "run", "--rm")
+
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	// On macOS, Env should be set
+	if cmd.Env == nil {
+		t.Error("On macOS, cmd.Env should be set with enhanced PATH")
+	}
+
+	// Verify PATH is in the environment
+	foundPath := false
+	for _, e := range cmd.Env {
+		if strings.HasPrefix(e, "PATH=") {
+			foundPath = true
+			// Verify the engine directory is in the PATH
+			if !strings.Contains(e, tempDir) {
+				t.Errorf("Enhanced PATH should contain engine directory %s, got %s", tempDir, e)
+			}
+			break
+		}
+	}
+	if !foundPath {
+		t.Error("Enhanced PATH should contain PATH= entry")
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_MacOS_AddsDockerPaths(t *testing.T) {
+	// Mock OS to be macOS
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	cmd := createCommandWithEnhancedPath("/usr/local/bin/docker", "--version")
+
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	// On macOS, Env should be set
+	if cmd.Env == nil {
+		t.Error("On macOS, cmd.Env should be set")
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_MacOS_DeduplicatesPaths(t *testing.T) {
+	// Mock OS to be macOS
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osDarwin }
+
+	// Set PATH to include one of the fallback paths
+	oldPath := os.Getenv("PATH")
+	defer func() { _ = os.Setenv("PATH", oldPath) }()
+	_ = os.Setenv("PATH", "/usr/local/bin:/usr/bin")
+
+	cmd := createCommandWithEnhancedPath("/usr/local/bin/docker", "--version")
+
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	// Verify PATH doesn't have duplicates
+	for _, e := range cmd.Env {
+		if strings.HasPrefix(e, "PATH=") {
+			pathValue := strings.TrimPrefix(e, "PATH=")
+			parts := strings.Split(pathValue, string(os.PathListSeparator))
+			seen := make(map[string]int)
+			for _, p := range parts {
+				seen[p]++
+				if seen[p] > 1 {
+					t.Errorf("PATH contains duplicate entry: %s", p)
+				}
+			}
+			break
+		}
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_NonMacOS_NoEnhancement(t *testing.T) {
+	// Mock OS to be Linux
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osLinux }
+
+	cmd := createCommandWithEnhancedPath("/usr/bin/docker", "run")
+
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	// On non-macOS, Env should be nil (uses parent environment)
+	if cmd.Env != nil {
+		t.Error("On non-macOS, cmd.Env should be nil")
+	}
+}
+
+func TestCreateCommandWithEnhancedPath_Windows_NoEnhancement(t *testing.T) {
+	// Mock OS to be Windows
+	origGOOS := getOS
+	defer func() { getOS = origGOOS }()
+	getOS = func() string { return osWindows }
+
+	cmd := createCommandWithEnhancedPath("C:\\Program Files\\Docker\\docker.exe", "run")
+
+	if cmd == nil {
+		t.Fatal("createCommandWithEnhancedPath should not return nil")
+	}
+
+	// On Windows, Env should be nil (uses parent environment)
+	if cmd.Env != nil {
+		t.Error("On Windows, cmd.Env should be nil")
+	}
+}
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
index 894c981a4..4986e97cb 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
@@ -600,7 +600,7 @@ func TestGetFallbackPaths_Podman_Darwin(t *testing.T) {
 func TestGetFallbackPaths_NonDarwin(t *testing.T) {
 	origGOOS := getOS
 	defer func() { getOS = origGOOS }()
-	getOS = func() string { return "linux" }
+	getOS = func() string { return osLinux }
 
 	fallbackDir := testFallbackDir
 	paths := getFallbackPaths(engineDocker, fallbackDir)
@@ -778,7 +778,7 @@ func TestGetFallbackPaths_PrimaryPathFirst(t *testing.T) {
 func TestGetFallbackPaths_EmptyFallbackDir(t *testing.T) {
 	origGOOS := getOS
 	defer func() { getOS = origGOOS }()
-	getOS = func() string { return "linux" }
+	getOS = func() string { return osLinux }
 
 	paths := getFallbackPaths(engineDocker, "")
 
@@ -876,7 +876,7 @@ func TestEngineNameResolution_FallbackPathsChecked(t *testing.T) {
 
 	origGOOS := getOS
 	defer func() { getOS = origGOOS }()
-	getOS = func() string { return "linux" }
+	getOS = func() string { return osLinux }
 
 	// Save and clear PATH
 	oldPath := os.Getenv("PATH")
@@ -899,7 +899,7 @@ func TestEngineNameResolution_FallbackPathsChecked(t *testing.T) {
 func TestEngineNameResolution_EmptyEngineName(t *testing.T) {
 	origGOOS := getOS
 	defer func() { getOS = origGOOS }()
-	getOS = func() string { return "linux" }
+	getOS = func() string { return osLinux }
 
 	// Save and clear PATH
 	oldPath := os.Getenv("PATH")
@@ -1079,3 +1079,129 @@ func TestFilterIgnoredFindings_PreservesOrder(t *testing.T) {
 		}
 	}
 }
+
+// ============================================================================
+// Tests for loadIgnoredIacFindings function
+// ============================================================================
+
+func TestLoadIgnoredIacFindings_ValidFile(t *testing.T) {
+	tempDir := t.TempDir()
+	testFile := filepath.Join(tempDir, "ignored.json")
+
+	// Create valid JSON file
+	content := `[
+		{"title": "Finding1", "similarityId": "id1"},
+		{"title": "Finding2", "similarityId": "id2"}
+	]`
+	err := os.WriteFile(testFile, []byte(content), 0644)
+	if err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	findings, err := loadIgnoredIacFindings(testFile)
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if len(findings) != 2 {
+		t.Errorf("Expected 2 findings, got %d", len(findings))
+	}
+
+	if findings[0].Title != "Finding1" || findings[0].SimilarityID != "id1" {
+		t.Errorf("First finding mismatch: %+v", findings[0])
+	}
+}
+
+func TestLoadIgnoredIacFindings_EmptyArray(t *testing.T) {
+	tempDir := t.TempDir()
+	testFile := filepath.Join(tempDir, "ignored.json")
+
+	err := os.WriteFile(testFile, []byte("[]"), 0644)
+	if err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	findings, err := loadIgnoredIacFindings(testFile)
+
+	if err != nil {
+		t.Errorf("Expected no error, got %v", err)
+	}
+
+	if len(findings) != 0 {
+		t.Errorf("Expected 0 findings, got %d", len(findings))
+	}
+}
+
+func TestLoadIgnoredIacFindings_InvalidJSON(t *testing.T) {
+	tempDir := t.TempDir()
+	testFile := filepath.Join(tempDir, "ignored.json")
+
+	err := os.WriteFile(testFile, []byte("not valid json"), 0644)
+	if err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	_, err = loadIgnoredIacFindings(testFile)
+
+	if err == nil {
+		t.Error("Expected error for invalid JSON, got nil")
+	}
+}
+
+func TestLoadIgnoredIacFindings_FileNotFound(t *testing.T) {
+	_, err := loadIgnoredIacFindings("/non/existent/file.json")
+
+	if err == nil {
+		t.Error("Expected error for non-existent file, got nil")
+	}
+}
+
+func TestLoadIgnoredIacFindings_EmptyFile(t *testing.T) {
+	tempDir := t.TempDir()
+	testFile := filepath.Join(tempDir, "ignored.json")
+
+	err := os.WriteFile(testFile, []byte(""), 0644)
+	if err != nil {
+		t.Fatalf("Failed to create test file: %v", err)
+	}
+
+	_, err = loadIgnoredIacFindings(testFile)
+
+	if err == nil {
+		t.Error("Expected error for empty file, got nil")
+	}
+}
+
+// ============================================================================
+// Additional tests for verifyEnginePath function - testing with real executable
+// ============================================================================
+
+func TestVerifyEnginePath_DirectoryInsteadOfFile(t *testing.T) {
+	tempDir := t.TempDir()
+
+	result := verifyEnginePath(tempDir)
+	if result {
+		t.Error("verifyEnginePath should return false for directory path")
+	}
+}
+
+func TestVerifyEnginePath_ValidSystemExecutable(t *testing.T) {
+	// Test with a known system executable
+	var execPath string
+	if runtime.GOOS == osWindows {
+		execPath = "C:\\Windows\\System32\\cmd.exe"
+	} else {
+		execPath = "/bin/sh"
+	}
+
+	// Check if the executable exists first
+	if _, err := os.Stat(execPath); err != nil {
+		t.Skipf("System executable not found: %s", execPath)
+	}
+
+	result := verifyEnginePath(execPath)
+	if !result {
+		t.Errorf("verifyEnginePath should return true for valid executable: %s", execPath)
+	}
+}

From 128eb98e2791b024349871feb52c8f908e5ef0d9 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Fri, 30 Jan 2026 17:04:31 +0530
Subject: [PATCH 11/17] Refactor createCommandWithEnhancedPath to improve PATH
 handling and update TestVerifyEnginePath to skip on non-Windows systems

---
 .../iacrealtime/container-manager.go               | 12 +++++++-----
 .../iacrealtime/iac-realtime_test.go               | 14 ++++++++------
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index 64aec66ac..892843dc9 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -77,11 +77,13 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	// Build enhanced PATH (prepend additional paths to ensure they take priority)
 	var enhancedPathParts []string
 	for _, p := range additionalPaths {
-		// Only add if not already in PATH and directory exists
-		if !pathSet[p] {
-			if _, err := os.Stat(p); err == nil {
-				enhancedPathParts = append(enhancedPathParts, p)
-			}
+		// Skip if already in PATH
+		if pathSet[p] {
+			continue
+		}
+		// Only add if directory exists
+		if _, err := os.Stat(p); err == nil {
+			enhancedPathParts = append(enhancedPathParts, p)
 		}
 	}
 	enhancedPathParts = append(enhancedPathParts, currentPath)
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
index 4986e97cb..72117a2e2 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
@@ -1187,14 +1187,16 @@ func TestVerifyEnginePath_DirectoryInsteadOfFile(t *testing.T) {
 }
 
 func TestVerifyEnginePath_ValidSystemExecutable(t *testing.T) {
-	// Test with a known system executable
-	var execPath string
-	if runtime.GOOS == osWindows {
-		execPath = "C:\\Windows\\System32\\cmd.exe"
-	} else {
-		execPath = "/bin/sh"
+	// This test only runs on Windows because:
+	// - On Linux, common executables like /bin/sh don't properly support --version flag
+	// - The verifyEnginePath function is designed for Docker/Podman which do support --version
+	// - We have other tests covering the main code paths (directory check, file existence, etc.)
+	if runtime.GOOS != osWindows {
+		t.Skip("Skipping on non-Windows: system executables may not support --version flag")
 	}
 
+	execPath := "C:\\Windows\\System32\\cmd.exe"
+
 	// Check if the executable exists first
 	if _, err := os.Stat(execPath); err != nil {
 		t.Skipf("System executable not found: %s", execPath)

From 0af77f3f2df2790f64609c753a3b15f0fe7748a2 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Fri, 30 Jan 2026 17:43:46 +0530
Subject: [PATCH 12/17] Fix duplicate path handling in getFallbackPaths
 function

---
 .../services/realtimeengine/iacrealtime/iac-realtime.go    | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime.go b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
index 7fc8455ea..078276033 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime.go
@@ -195,10 +195,11 @@ func getFallbackPaths(engineName, fallBackDir string) []string {
 
 		for _, dir := range additionalPaths {
 			enginePath := filepath.Join(dir, engineName)
-			// Avoid duplicates
-			if enginePath != filepath.Join(fallBackDir, engineName) {
-				paths = append(paths, enginePath)
+			// Skip duplicates
+			if enginePath == filepath.Join(fallBackDir, engineName) {
+				continue
 			}
+			paths = append(paths, enginePath)
 		}
 
 		// Add user home-based paths

From 282f6d94b380fe7655644356aa7f609babbfd6a9 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Mon, 2 Feb 2026 11:06:37 +0530
Subject: [PATCH 13/17] Fix directory existence check in
 createCommandWithEnhancedPath to skip non-existent paths

---
 .../realtimeengine/iacrealtime/container-manager.go        | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index 892843dc9..ff50dc2a5 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -81,10 +81,11 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 		if pathSet[p] {
 			continue
 		}
-		// Only add if directory exists
-		if _, err := os.Stat(p); err == nil {
-			enhancedPathParts = append(enhancedPathParts, p)
+		// Skip if directory doesn't exist
+		if _, err := os.Stat(p); err != nil {
+			continue
 		}
+		enhancedPathParts = append(enhancedPathParts, p)
 	}
 	enhancedPathParts = append(enhancedPathParts, currentPath)
 	enhancedPath := strings.Join(enhancedPathParts, string(os.PathListSeparator))

From ffc97eabcb809cb1dcd1acf5899e2fbc946ce7c0 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Mon, 2 Feb 2026 11:21:09 +0530
Subject: [PATCH 14/17] Fix PATH environment variable setting in
 createCommandWithEnhancedPath to ensure proper enhancement

---
 .../realtimeengine/iacrealtime/container-manager.go        | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index ff50dc2a5..54a38f7d4 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -93,10 +93,11 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	// Set the enhanced PATH in the command's environment (replace existing PATH)
 	env := os.Environ()
 	for i, e := range env {
-		if strings.HasPrefix(e, "PATH=") {
-			env[i] = "PATH=" + enhancedPath
-			break
+		if !strings.HasPrefix(e, "PATH=") {
+			continue
 		}
+		env[i] = "PATH=" + enhancedPath
+		break
 	}
 	cmd.Env = env
 

From 0233d326a871c284626832ebbd1a89925cd949d6 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Mon, 2 Feb 2026 11:33:27 +0530
Subject: [PATCH 15/17] Refactor path checks in tests to improve readability
 and maintainability

---
 .../iacrealtime/container-manager_test.go     | 43 ++++++++++---------
 .../iacrealtime/iac-realtime_test.go          | 28 ++++++------
 2 files changed, 39 insertions(+), 32 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager_test.go b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
index e71167e45..96c01b257 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager_test.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
@@ -536,10 +536,11 @@ func TestCreateCommandWithEnhancedPath_EnvIsSet(t *testing.T) {
 	if cmd.Env != nil {
 		foundPath := false
 		for _, e := range cmd.Env {
-			if strings.HasPrefix(e, "PATH=") {
-				foundPath = true
-				break
+			if !strings.HasPrefix(e, "PATH=") {
+				continue
 			}
+			foundPath = true
+			break
 		}
 		if !foundPath {
 			t.Error("If Env is set, it should contain PATH")
@@ -575,14 +576,15 @@ func TestCreateCommandWithEnhancedPath_MacOS_EnhancesPath(t *testing.T) {
 	// Verify PATH is in the environment
 	foundPath := false
 	for _, e := range cmd.Env {
-		if strings.HasPrefix(e, "PATH=") {
-			foundPath = true
-			// Verify the engine directory is in the PATH
-			if !strings.Contains(e, tempDir) {
-				t.Errorf("Enhanced PATH should contain engine directory %s, got %s", tempDir, e)
-			}
-			break
+		if !strings.HasPrefix(e, "PATH=") {
+			continue
 		}
+		foundPath = true
+		// Verify the engine directory is in the PATH
+		if !strings.Contains(e, tempDir) {
+			t.Errorf("Enhanced PATH should contain engine directory %s, got %s", tempDir, e)
+		}
+		break
 	}
 	if !foundPath {
 		t.Error("Enhanced PATH should contain PATH= entry")
@@ -626,18 +628,19 @@ func TestCreateCommandWithEnhancedPath_MacOS_DeduplicatesPaths(t *testing.T) {
 
 	// Verify PATH doesn't have duplicates
 	for _, e := range cmd.Env {
-		if strings.HasPrefix(e, "PATH=") {
-			pathValue := strings.TrimPrefix(e, "PATH=")
-			parts := strings.Split(pathValue, string(os.PathListSeparator))
-			seen := make(map[string]int)
-			for _, p := range parts {
-				seen[p]++
-				if seen[p] > 1 {
-					t.Errorf("PATH contains duplicate entry: %s", p)
-				}
+		if !strings.HasPrefix(e, "PATH=") {
+			continue
+		}
+		pathValue := strings.TrimPrefix(e, "PATH=")
+		parts := strings.Split(pathValue, string(os.PathListSeparator))
+		seen := make(map[string]int)
+		for _, p := range parts {
+			seen[p]++
+			if seen[p] > 1 {
+				t.Errorf("PATH contains duplicate entry: %s", p)
 			}
-			break
 		}
+		break
 	}
 }
 
diff --git a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
index 72117a2e2..88a271e55 100644
--- a/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
+++ b/internal/services/realtimeengine/iacrealtime/iac-realtime_test.go
@@ -529,10 +529,11 @@ func TestGetFallbackPaths_Docker_Darwin(t *testing.T) {
 	expectedPrimary := filepath.Join(fallbackDir, engineDocker)
 	found := false
 	for _, p := range paths {
-		if p == expectedPrimary {
-			found = true
-			break
+		if p != expectedPrimary {
+			continue
 		}
+		found = true
+		break
 	}
 	if !found {
 		t.Errorf("Expected primary fallback path %s in paths", expectedPrimary)
@@ -546,10 +547,11 @@ func TestGetFallbackPaths_Docker_Darwin(t *testing.T) {
 		}
 		found = false
 		for _, p := range paths {
-			if p == expectedPath {
-				found = true
-				break
+			if p != expectedPath {
+				continue
 			}
+			found = true
+			break
 		}
 		if !found {
 			t.Errorf("Expected macOS fallback path %s in paths", expectedPath)
@@ -569,10 +571,11 @@ func TestGetFallbackPaths_Podman_Darwin(t *testing.T) {
 	expectedPrimary := filepath.Join(fallbackDir, enginePodman)
 	found := false
 	for _, p := range paths {
-		if p == expectedPrimary {
-			found = true
-			break
+		if p != expectedPrimary {
+			continue
 		}
+		found = true
+		break
 	}
 	if !found {
 		t.Errorf("Expected primary fallback path %s in paths", expectedPrimary)
@@ -586,10 +589,11 @@ func TestGetFallbackPaths_Podman_Darwin(t *testing.T) {
 		}
 		found = false
 		for _, p := range paths {
-			if p == expectedPath {
-				found = true
-				break
+			if p != expectedPath {
+				continue
 			}
+			found = true
+			break
 		}
 		if !found {
 			t.Errorf("Expected macOS fallback path %s in paths", expectedPath)

From 9587e8c391bf36008098a3c77a0c42011ad7b9f2 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Mon, 2 Feb 2026 18:10:20 +0530
Subject: [PATCH 16/17] Refactor EnsureImageAvailable method in
 ContainerManager to return resolved engine path and error. Update related
 tests to handle new return values accordingly.

---
 .../iacrealtime/container-manager.go          | 23 ++++++++-----------
 .../iacrealtime/container-manager_test.go     | 14 +++++------
 2 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index 54a38f7d4..4c14f3288 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -18,7 +18,7 @@ import (
 type IContainerManager interface {
 	GenerateContainerID() string
 	RunKicsContainer(engine, volumeMap string) error
-	EnsureImageAvailable(engine string) error
+	EnsureImageAvailable(engine string) (string, error)
 }
 
 // ContainerManager handles Docker container operations
@@ -106,14 +106,15 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	return cmd
 }
 
-// EnsureImageAvailable checks if the KICS Docker image exists locally and pulls it if not available
-func (dm *ContainerManager) EnsureImageAvailable(engine string) error {
+// EnsureImageAvailable checks if the KICS Docker image exists locally and pulls it if not available.
+// Returns the resolved engine path on success.
+func (dm *ContainerManager) EnsureImageAvailable(engine string) (string, error) {
 	logger.PrintIfVerbose("Resolving container engine: " + engine)
 
 	resolvedEngine, err := engineNameResolution(engine, IacEnginePath)
 	if err != nil {
 		logger.PrintIfVerbose("Failed to resolve container engine '" + engine + "': " + err.Error())
-		return errors.Wrapf(err, "container engine '%s' not found. On macOS, if Docker is installed but not found, "+
+		return "", errors.Wrapf(err, "container engine '%s' not found. On macOS, if Docker is installed but not found, "+
 			"try launching the IDE from terminal or ensure Docker Desktop is running", engine)
 	}
 
@@ -125,7 +126,7 @@ func (dm *ContainerManager) EnsureImageAvailable(engine string) error {
 	inspectCmd := createCommandWithEnhancedPath(resolvedEngine, "image", "inspect", util.ContainerImage)
 	if err := inspectCmd.Run(); err == nil {
 		logger.PrintIfVerbose("KICS Docker image found locally: " + util.ContainerImage)
-		return nil
+		return resolvedEngine, nil
 	}
 
 	// Image not found locally, attempt to pull
@@ -138,24 +139,20 @@ func (dm *ContainerManager) EnsureImageAvailable(engine string) error {
 		logger.PrintIfVerbose("Failed to pull KICS image. Output: " + outputStr)
 
 		if outputStr != "" {
-			return errors.Errorf("Failed to pull KICS Docker image '%s': %s. Please check your network connectivity or pull the image manually using: %s pull %s",
+			return "", errors.Errorf("Failed to pull KICS Docker image '%s': %s. Please check your network connectivity or pull the image manually using: %s pull %s",
 				util.ContainerImage, outputStr, resolvedEngine, util.ContainerImage)
 		}
-		return errors.Errorf("Failed to pull KICS Docker image '%s': %v. Please check your network connectivity or pull the image manually using: %s pull %s",
+		return "", errors.Errorf("Failed to pull KICS Docker image '%s': %v. Please check your network connectivity or pull the image manually using: %s pull %s",
 			util.ContainerImage, pullErr, resolvedEngine, util.ContainerImage)
 	}
 
 	logger.PrintIfVerbose("Successfully pulled KICS Docker image: " + util.ContainerImage)
-	return nil
+	return resolvedEngine, nil
 }
 
 func (dm *ContainerManager) RunKicsContainer(engine, volumeMap string) error {
 	// Ensure the KICS image is available before running
-	if err := dm.EnsureImageAvailable(engine); err != nil {
-		return err
-	}
-
-	resolvedEngine, err := engineNameResolution(engine, IacEnginePath)
+	resolvedEngine, err := dm.EnsureImageAvailable(engine)
 	if err != nil {
 		return err
 	}
diff --git a/internal/services/realtimeengine/iacrealtime/container-manager_test.go b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
index 96c01b257..2a2261121 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager_test.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager_test.go
@@ -66,17 +66,17 @@ func (m *MockContainerManager) RunKicsContainer(engine, volumeMap string) error
 	return nil
 }
 
-func (m *MockContainerManager) EnsureImageAvailable(engine string) error {
+func (m *MockContainerManager) EnsureImageAvailable(engine string) (string, error) {
 	m.EnsureImageAvailableCalls = append(m.EnsureImageAvailableCalls, engine)
 
 	if m.ShouldFailEnsureImage {
 		if m.EnsureImageError != nil {
-			return m.EnsureImageError
+			return "", m.EnsureImageError
 		}
-		return &exec.Error{Name: engine, Err: nil}
+		return "", &exec.Error{Name: engine, Err: nil}
 	}
 
-	return nil
+	return engine, nil
 }
 
 func TestNewMockContainerManager(t *testing.T) {
@@ -288,7 +288,7 @@ func TestMockContainerManager_Integration(t *testing.T) {
 func TestMockContainerManager_EnsureImageAvailable(t *testing.T) {
 	dm := NewMockContainerManager()
 
-	err := dm.EnsureImageAvailable("docker")
+	_, err := dm.EnsureImageAvailable("docker")
 	if err != nil {
 		t.Errorf("EnsureImageAvailable should not fail by default: %v", err)
 	}
@@ -306,7 +306,7 @@ func TestMockContainerManager_EnsureImageAvailable_Failure(t *testing.T) {
 	dm := NewMockContainerManager()
 	dm.ShouldFailEnsureImage = true
 
-	err := dm.EnsureImageAvailable("docker")
+	_, err := dm.EnsureImageAvailable("docker")
 	if err == nil {
 		t.Error("EnsureImageAvailable should fail when configured to fail")
 	}
@@ -353,7 +353,7 @@ func TestMockContainerManager_EnsureImageAvailable_CustomError(t *testing.T) {
 	customErr := &exec.Error{Name: "custom", Err: nil}
 	dm.EnsureImageError = customErr
 
-	err := dm.EnsureImageAvailable("docker")
+	_, err := dm.EnsureImageAvailable("docker")
 	if err != customErr {
 		t.Error("EnsureImageAvailable should return custom error when set")
 	}

From 75142d22e84d292fffb9e5e484fd4c1250d44da0 Mon Sep 17 00:00:00 2001
From: Amol Mane <22643905+cx-amol-mane@users.noreply.github.com>
Date: Tue, 3 Feb 2026 14:10:55 +0530
Subject: [PATCH 17/17] Update logging messages in EnsureImageAvailable method
 to use 'KICS image' instead of 'KICS Docker image' for consistency and
 clarity.

---
 .../iacrealtime/container-manager.go             | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/internal/services/realtimeengine/iacrealtime/container-manager.go b/internal/services/realtimeengine/iacrealtime/container-manager.go
index 4c14f3288..77a833b8b 100644
--- a/internal/services/realtimeengine/iacrealtime/container-manager.go
+++ b/internal/services/realtimeengine/iacrealtime/container-manager.go
@@ -106,7 +106,7 @@ func createCommandWithEnhancedPath(enginePath string, args ...string) *exec.Cmd
 	return cmd
 }
 
-// EnsureImageAvailable checks if the KICS Docker image exists locally and pulls it if not available.
+// EnsureImageAvailable checks if the KICS image exists locally and pulls it if not available.
 // Returns the resolved engine path on success.
 func (dm *ContainerManager) EnsureImageAvailable(engine string) (string, error) {
 	logger.PrintIfVerbose("Resolving container engine: " + engine)
@@ -114,8 +114,8 @@ func (dm *ContainerManager) EnsureImageAvailable(engine string) (string, error)
 	resolvedEngine, err := engineNameResolution(engine, IacEnginePath)
 	if err != nil {
 		logger.PrintIfVerbose("Failed to resolve container engine '" + engine + "': " + err.Error())
-		return "", errors.Wrapf(err, "container engine '%s' not found. On macOS, if Docker is installed but not found, "+
-			"try launching the IDE from terminal or ensure Docker Desktop is running", engine)
+		return "", errors.Wrapf(err, "container engine '%s' not found. On macOS, if Docker/Podman is installed but not found, "+
+			"try launching the IDE from terminal or ensure Docker/Podman is running", engine)
 	}
 
 	logger.PrintIfVerbose("Using container engine at: " + resolvedEngine)
@@ -125,12 +125,12 @@ func (dm *ContainerManager) EnsureImageAvailable(engine string) (string, error)
 
 	inspectCmd := createCommandWithEnhancedPath(resolvedEngine, "image", "inspect", util.ContainerImage)
 	if err := inspectCmd.Run(); err == nil {
-		logger.PrintIfVerbose("KICS Docker image found locally: " + util.ContainerImage)
+		logger.PrintIfVerbose("KICS image found locally: " + util.ContainerImage)
 		return resolvedEngine, nil
 	}
 
 	// Image not found locally, attempt to pull
-	logger.PrintIfVerbose("KICS Docker image not found locally. Attempting to pull: " + util.ContainerImage)
+	logger.PrintIfVerbose("KICS image not found locally. Attempting to pull: " + util.ContainerImage)
 
 	pullCmd := createCommandWithEnhancedPath(resolvedEngine, "pull", util.ContainerImage)
 	output, pullErr := pullCmd.CombinedOutput()
@@ -139,14 +139,14 @@ func (dm *ContainerManager) EnsureImageAvailable(engine string) (string, error)
 		logger.PrintIfVerbose("Failed to pull KICS image. Output: " + outputStr)
 
 		if outputStr != "" {
-			return "", errors.Errorf("Failed to pull KICS Docker image '%s': %s. Please check your network connectivity or pull the image manually using: %s pull %s",
+			return "", errors.Errorf("Failed to pull KICS image '%s': %s. Please check your network connectivity or pull the image manually using: %s pull %s",
 				util.ContainerImage, outputStr, resolvedEngine, util.ContainerImage)
 		}
-		return "", errors.Errorf("Failed to pull KICS Docker image '%s': %v. Please check your network connectivity or pull the image manually using: %s pull %s",
+		return "", errors.Errorf("Failed to pull KICS image '%s': %v. Please check your network connectivity or pull the image manually using: %s pull %s",
 			util.ContainerImage, pullErr, resolvedEngine, util.ContainerImage)
 	}
 
-	logger.PrintIfVerbose("Successfully pulled KICS Docker image: " + util.ContainerImage)
+	logger.PrintIfVerbose("Successfully pulled KICS image: " + util.ContainerImage)
 	return resolvedEngine, nil
 }