fix(reformat): reformat overwrites content (#4672)

This pull request fixes an issue where the current reformat logic could
unintentionally overwrite content following the `query` field in an
artifact. This most commonly affected artifacts that define additional
fields such as `notebook` or `column_types`.

For example, given the following artifact with a `notebook` field:

```yaml
name: Notebook
sources:
- query: |
    SELECT A,B,C
    FROM scope()
  notebook:
    - name: Test
      type: vql_suggestion
      template: |
        SELECT * FROM scope()
```

Running the reformat command (either via CLI or the GUI) would remove
the `notebook:` line. Subsequent reformats would continue stripping
content, producing an invalid artifact such as:

```yaml
name: Notebook
sources:
- query: |
    SELECT A,
           B,
           C
    FROM scope()
    - name: Test
      type: vql_suggestion
      template: |
        SELECT * FROM scope()
```

> Error: While parsing VQL at line 8: unexpected token "-"

The root cause was an off-by-one error in the mutation logic applied to
the `query` block, which caused the reformat operation to extend beyond
the intended range. While addressing this, I also identified an issue
with how `original_end_line` was calculated for chomping indicator nodes
(`|-`). Because these nodes omit the trailing newline, splitting on `\n`
resulted in an incorrect end line calculation.

Additionally, the `current_mu.err` value was never checked when applying
mutations that only had a length of one. This has also been resolved by
adding an additional check at the beginning of the line iteration.

This change corrects these issues and adds regression tests to verify
that:
- Content following a `query` block is preserved.
- Running reformat multiple times produces stable, idempotent output.

Please let me know if you'd like further clarification, or if there are
any changes you'd like made.

I am also considering a refactor of the `artifacts reformat` to call a
`reformat` VQL function which wraps this functionality, following the
pattern that CLI commands are just wrappers around VQL. Let me know if
this is also something you'd be interested in me contributing. 😃

Author: nullifysecurity

services/repository/fixtures/TestReformat.golden

@@ -23,14 +23,16 @@
   "- query: SELECT * FROM info()",
   "- query: |",
   "    SELECT A",
-  "    FROM scope()"
+  "    FROM scope()",
+  ""
  ],
  "export reformatted": [
   "",
   "name: Exported",
   "export: |",
   "  SELECT *",
-  "  FROM scope()"
+  "  FROM scope()",
+  ""
  ],
  "preconditions": [
   "",
@@ -39,6 +41,37 @@
   "sources:",
   "- precondition: |",
   "    SELECT *",
-  "    FROM info()"
+  "    FROM info()",
+  ""
+ ],
+ "notebook": [
+  "",
+  "name: Notebook",
+  "sources:",
+  "- query: |",
+  "    SELECT A,",
+  "           B,",
+  "           C",
+  "    FROM scope()",
+  "  notebook:",
+  "    - name: Test",
+  "      type: vql_suggestion",
+  "      template: |",
+  "        SELECT * FROM scope()",
+  ""
+ ],
+ "column types": [
+  "",
+  "name: Column Types",
+  "sources:",
+  "- query: |",
+  "    SELECT A,",
+  "           B,",
+  "           C",
+  "    FROM scope()",
+  "column_types:",
+  "  - name: A",
+  "    type: string",
+  ""
  ]
 }

services/repository/reformat.go

@@ -85,11 +85,16 @@ func reformatNode(vql_node yaml.NodeContext) (m mutation, err error) {
 		indented = append(indented, ind+l)
 	}
 
+	// Check if node style is chomping (no final new line)
+	length := len(strings.Split(vql_node.Value, "\n"))
+	if strings.HasSuffix(vql_node.Value, "\n") {
+		length--
+	}
+
 	return mutation{
 		original_start_line: vql_node.Line,
-		original_end_line: vql_node.Line +
-			len(strings.Split(vql_node.Value, "\n")) - 1,
-		replacement: indented,
+		original_end_line:   vql_node.Line + length,
+		replacement:         indented,
 	}, nil
 }
 
@@ -103,6 +108,10 @@ func applyMutations(text string, mu []mutation) (string, error) {
 	current_mu_idx := 0
 
 	for i := 0; i < len(lines); {
+		if current_mu.err != nil {
+			return text, current_mu.err
+		}
+
 		if i < current_mu.original_start_line {
 			result = append(result, lines[i])
 			i++
@@ -111,10 +120,15 @@ func applyMutations(text string, mu []mutation) (string, error) {
 
 		if i == current_mu.original_start_line {
 			result = append(result, current_mu.replacement...)
+
 			i = current_mu.original_end_line
+			if current_mu.original_end_line == current_mu.original_start_line {
+				i++
+			}
+
 			if current_mu_idx+1 >= len(mu) {
 				// No more mutations, just copy the rest and return
-				result = append(result, lines[i+1:]...)
+				result = append(result, lines[i:]...)
 				return strings.Join(result, "\n"), nil
 			}
 			current_mu_idx++

services/repository/reformat_test.go

@@ -47,6 +47,30 @@ precondition: SELECT * FROM info()
 sources:
 - precondition: |
    SELECT * FROM info()
+`}, {
+		name: "notebook",
+		in: `
+name: Notebook
+sources:
+- query: |
+    SELECT A,B,C
+    FROM scope()
+  notebook:
+    - name: Test
+      type: vql_suggestion
+      template: |
+        SELECT * FROM scope()
+`}, {
+		name: "column types",
+		in: `
+name: Column Types
+sources:
+- query: |
+    SELECT A,B,C
+    FROM scope()
+column_types:
+  - name: A
+    type: string
 `},
 }
 
@@ -59,3 +83,15 @@ func TestReformat(t *testing.T) {
 	}
 	goldie.AssertJson(t, "TestReformat", golden)
 }
+
+// Test that when VQL is reformatted multiple times it doesn't change.
+func TestReformatMultiple(t *testing.T) {
+	golden := ordereddict.NewDict()
+	for _, c := range reformatCases {
+		first, err := reformatVQL(c.in)
+		second, err := reformatVQL(first)
+		assert.NoError(t, err)
+		golden.Set(c.name, strings.Split(second, "\n"))
+	}
+	goldie.AssertJson(t, "TestReformat", golden)
+}