`checkmarx` commands broken — PR #284's `buildUrl()` fix doubles the `/api` path segment

[kolatts]

• Affects: pncli main (post-v1.18.0, PR fix: preserve base URL path segments in buildUrl() for Managed Dynatrace hosts #284, commit 87fef4b) — regression introduced while fixing BUG-23
• Symptom: Every checkmarx command (project list/get, scan list/get/stats) and config test/config check's checkmarx probe now fail with HTTP 404 Not Found. Requests are sent to https://<tenant>.cxone.cloud/api/api/projects (doubled /api) instead of https://<tenant>.cxone.cloud/api/projects.
• Repro: pncli checkmarx project list with checkmarx.baseUrl = https://vcr.cxone.cloud/api → {"ok":false,"error":{"status":404,"message":"HTTP 404 Not Found","url":"https://vcr.cxone.cloud/api/api/projects?limit=100"}}. Every other checkmarx subcommand (project get, scan list/get, scan stats) shows the identical /api/api/... doubling.
• Expected: Request should go to https://vcr.cxone.cloud/api/projects (no doubled segment).
• Notes: This is a direct regression from the BUG-23 fix (PR fix: preserve base URL path segments in buildUrl() for Managed Dynatrace hosts #284, 87fef4b). CheckmarxClient (src/services/checkmarx/client.ts) builds every endpoint path with a leading /api/... (e.g. /api/projects, /api/scans, /api/results/summary), and pncli's documented/example config convention for checkmarx.baseUrl already includes a trailing /api (e.g. https://<tenant>.cxone.cloud/api — see skills/pncli/checkmarx.md and this repo's .env.example). Under the old, buggy buildUrl(), an absolute-path reference resolved against the origin only, so the base's own /api was silently discarded and the request happened to land on the right URL "by accident" (origin + /api/projects == the intended URL). Now that buildUrl() correctly preserves the base's path, the base's own /api and the client's own leading /api both survive and get concatenated, producing /api/api/projects. This means the previous "working" checkmarx behavior relied on the exact same URL-resolution bug this session already flagged as BUG-23/BUG-4 — fixing it for Dynatrace unmasked a latent path-convention mismatch in the Checkmarx client. Fix options: (a) change CheckmarxClient's paths to be relative (drop the leading /api/, i.e. just projects, scans, results/summary) since baseUrl already supplies it — mirrors how BUG-4 was fixed for Artifactory; or (b) change the documented checkmarx.baseUrl convention to be the tenant root (no trailing /api) and keep the client's /api/... paths as-is. Option (a) requires no user-facing config changes and is recommended.

Service: Checkmarx

---

Submitted via kolatts.github.io/pncli

[claude]

Claude finished @kolatts's task in 3m 54s —— View job • claude/issue-285-20260729-2121 • Create PR ➔

---

Triage: checkmarx commands broken — doubled /api path segment

• Gather context and read relevant files
• Check for duplicate issues — no duplicates found
• Assess feasibility — straightforward regression fix
• Implement fix: drop leading /api/ from all CheckmarxClient path strings
• Update tests to match new relative path strings
• Run typecheck ✓, lint ✓, tests ✓ (397/397 passed)
• Commit and push to claude/issue-285-20260729-2121
• Add triaged label

What was done

Root cause confirmed: CheckmarxClient used absolute paths like /api/projects, while checkmarx.baseUrl was documented to end with /api. Before PR #284, buildUrl() had a bug where absolute-path references discarded the base path — so the request accidentally landed on the right URL. After #284 fixed buildUrl() to preserve base path segments, the combination produced /api/api/projects.

Fix (Option a): Dropped the leading /api/ from all 5 CheckmarxClient path strings, making them relative (projects, projects/${id}, scans, scans/${id}, results/summary). They now resolve correctly against a base that already supplies /api. No user-facing config changes needed — mirrors the exact same fix applied to Artifactory for BUG-4.

Files changed:

• src/services/checkmarx/client.ts — 5 path strings made relative
• src/services/checkmarx/client.test.ts — updated expected path args

[github-actions]

Implemented in PR: #286