`checkmarx project list` / `checkmarx scan list` crash on an empty tenant — `null` array not handled

[kolatts]

• Affects: pncli v1.18.0 (main @ ff6e924, checkmarx project list, checkmarx scan list)
• Symptom: Against a Checkmarx One tenant with zero projects (or zero scans), both commands fail with Cannot read properties of null (reading 'length') instead of returning an empty list. The CxOne API returns {"totalCount":0,"filteredTotalCount":0,"projects":null} (projects/scans is null, not [], when there are no results), but CheckmarxClient.listProjects()/listScans() in src/services/checkmarx/client.ts unconditionally read res.projects.length / res.scans.length to build the "only showing first N" warning, which throws on null.
• Repro: Against an empty-but-authenticated CxOne tenant: pncli checkmarx project list → {"ok":false,"error":{"status":1,"message":"Cannot read properties of null (reading 'length')"}}. Same for pncli checkmarx scan list.
• Expected: Returns {"ok":true,"data":[]} (or similar) when the tenant has no projects/scans, matching the behavior of every other list command in pncli when a result set is empty.
• Notes: checkmarx project get, scan get, and scan stats handle missing/invalid IDs fine (clean 404/403 JSON errors), so the bug is isolated to the two list methods' truthiness/length check on a null array. Fix: guard with (res.projects ?? []).length (and use res.projects ?? [] as the returned value) — same for scans. test-checkmarx.ps1 marks these two assertions -Optional (documenting the current failure) until this is fixed upstream.

Service: Checkmarx

---

Submitted via kolatts.github.io/pncli

[claude]

Claude finished @kolatts's task in 2m 37s —— View job • claude/issue-277-20260729-1506 • Create PR ➔

---

Triage: Issue #277

• Gather context and read CLAUDE.md
• Check for duplicate issues — none found
• Read src/services/checkmarx/client.ts — bug confirmed on lines 15–18 and 29–32
• Assess feasibility — straightforward null-guard fix
• Implement fix in client.ts and types/checkmarx.ts
• Run typecheck, lint, tests — all 391 tests pass
• Commit and push
• Write PR title/body files

What was done

The CxOne API returns null (not []) for projects/scans when a tenant has no results. Both listProjects() and listScans() in src/services/checkmarx/client.ts unconditionally accessed .length on these fields, crashing with Cannot read properties of null (reading 'length').

Fix:

• src/types/checkmarx.ts — typed projects and scans as CxOneProject[] | null / CxOneScan[] | null to match the real API contract
• src/services/checkmarx/client.ts — added ?? [] guard in both list methods so an empty tenant returns {"ok":true,"data":[]} instead of crashing

[github-actions]

Implemented in PR: #278