mobbdev 0.0.90 → 0.0.93

package/dist/index.mjs

@@ -104,6 +104,12 @@ var errorMessages = {
     "(--token)"
   )} is needed if you're adding an SCM token`
 };
+var progressMassages = {
+  processingVulnerabilityReportSuccess: "\u2699\uFE0F  Vulnerability report proccessed successfully",
+  processingVulnerabilityReport: "\u2699\uFE0F  Proccessing vulnerability report",
+  processingVulnerabilityReportFailed: "\u2699\uFE0F  Error Proccessing vulnerability report"
+};
+var VUL_REPORT_DIGEST_TIMEOUT_MS = 1e3 * 60 * 20;
 
 // src/features/analysis/index.ts
 import crypto from "node:crypto";
@@ -118,6 +124,7 @@ __export(utils_exports, {
   CliError: () => CliError,
   Spinner: () => Spinner,
   getDirName: () => getDirName,
+  getTopLevelDirName: () => getTopLevelDirName,
   keypress: () => keypress,
   sleep: () => sleep
 });
@@ -128,6 +135,9 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 function getDirName() {
   return path2.dirname(fileURLToPath2(import.meta.url));
 }
+function getTopLevelDirName(fullPath) {
+  return path2.parse(fullPath).name;
+}
 
 // src/utils/keypress.ts
 import readline from "node:readline";
@@ -175,18 +185,19 @@ var CliError = class extends Error {
 // src/features/analysis/index.ts
 import chalk4 from "chalk";
 import Configstore from "configstore";
-import Debug10 from "debug";
+import Debug11 from "debug";
 import extract from "extract-zip";
 import fetch3 from "node-fetch";
 import open2 from "open";
 import semver from "semver";
 import tmp2 from "tmp";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 
 // src/features/analysis/git.ts
 import Debug2 from "debug";
 import { simpleGit } from "simple-git";
 var debug2 = Debug2("mobbdev:git");
+var GIT_NOT_INITIALIZED_ERROR_MESSAGE = "not a git repository";
 async function getGitInfo(srcDirPath) {
   debug2("getting git info for %s", srcDirPath);
   const git = simpleGit({
@@ -206,8 +217,14 @@ async function getGitInfo(srcDirPath) {
       debug2("failed to run git %o", e);
       if (e.message.includes(" spawn ")) {
         debug2("git cli not installed");
-      } else if (e.message.includes(" not a git repository ")) {
+      } else if (e.message.includes(GIT_NOT_INITIALIZED_ERROR_MESSAGE)) {
         debug2("folder is not a git repo");
+        return {
+          success: false,
+          hash: void 0,
+          reference: void 0,
+          repoUrl: void 0
+        };
       } else {
         throw e;
       }
@@ -221,6 +238,7 @@ async function getGitInfo(srcDirPath) {
     repoUrl = repoUrl.replace("git@github.com:", "https://github.com/");
   }
   return {
+    success: true,
     repoUrl,
     hash,
     reference
@@ -551,7 +569,7 @@ var GET_VUL_BY_NODES_METADATA = gql2`
 // src/features/analysis/graphql/subscirbe.ts
 import { createClient } from "graphql-ws";
 import WebSocket from "ws";
-var SUBSCRIPTION_TIMEOUT_MS = 5 * 60 * 1e3;
+var SUBSCRIPTION_TIMEOUT_MS = 10 * 60 * 1e3;
 function createWSClient(options) {
   return createClient({
     url: options.url,
@@ -1032,22 +1050,24 @@ var GQLClient = class {
       res
     ).vulnerability_report_path.map((p) => p.path);
   }
-  async subscribeToAnalysis(params, callback) {
+  async subscribeToAnalysis(params) {
+    const { callbackStates } = params;
     return subscribe(
       SUBSCRIBE_TO_ANALYSIS,
-      params,
+      params.subscribeToAnalysisParams,
       async (resolve, reject, data) => {
         if (data.analysis.state === "Failed") {
           reject(data);
           throw new Error(`Analysis failed with id: ${data.analysis.id}`);
         }
-        if (data.analysis?.state === "Finished") {
-          await callback(data.analysis.id);
+        if (callbackStates.includes(data.analysis?.state)) {
+          await params.callback(data.analysis.id);
           resolve(data);
         }
       },
       {
-        apiKey: this._apiKey
+        apiKey: this._apiKey,
+        timeoutInMs: params.timeoutInMs
       }
     );
   }
@@ -1079,18 +1099,18 @@ var GQLClient = class {
 
 // src/features/analysis/handle_finished_analysis.ts
 import { Octokit as Octokit3 } from "@octokit/core";
-import Debug4 from "debug";
+import Debug5 from "debug";
 import parseDiff from "parse-diff";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/features/analysis/scm/ado.ts
 import querystring2 from "node:querystring";
 import * as api from "azure-devops-node-api";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/features/analysis/scm/scm.ts
 import { Octokit as Octokit2 } from "@octokit/core";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // src/features/analysis/scm/github/encryptSecret.ts
 import sodium from "libsodium-wrappers";
@@ -1686,18 +1706,30 @@ function deleteGeneralPrComment(client, params) {
   return client.request(DELETE_GENERAL_PR_COMMENT, params);
 }
 
-// src/features/analysis/scm/gitlab.ts
+// src/features/analysis/scm/gitlab/gitlab.ts
 import querystring from "node:querystring";
-import { Gitlab } from "@gitbeaker/rest";
+import {
+  Gitlab
+} from "@gitbeaker/rest";
 import { ProxyAgent } from "undici";
+import { z as z5 } from "zod";
+
+// src/features/analysis/scm/gitlab/types.ts
 import { z as z4 } from "zod";
+var GitlabAuthResultZ = z4.object({
+  access_token: z4.string(),
+  token_type: z4.string(),
+  refresh_token: z4.string()
+});
+
+// src/features/analysis/scm/gitlab/gitlab.ts
+var EnvVariablesZod2 = z5.object({
+  GITLAB_API_TOKEN: z5.string().optional()
+});
+var { GITLAB_API_TOKEN } = EnvVariablesZod2.parse(process.env);
 function removeTrailingSlash2(str) {
   return str.trim().replace(/\/+$/, "");
 }
-var EnvVariablesZod2 = z4.object({
-  GITLAB_API_TOKEN: z4.string().optional()
-});
-var { GITLAB_API_TOKEN } = EnvVariablesZod2.parse(process.env);
 function getGitBeaker(options) {
   const token = options?.gitlabAuthToken ?? GITLAB_API_TOKEN ?? "";
   const url = options.url;
@@ -1850,6 +1882,18 @@ async function createMergeRequest(options) {
   );
   return res.iid;
 }
+async function getGitlabMergeRequest({
+  url,
+  prNumber,
+  accessToken
+}) {
+  const { projectPath } = parseGitlabOwnerAndRepo(url);
+  const api2 = getGitBeaker({
+    url,
+    gitlabAuthToken: accessToken
+  });
+  return await api2.MergeRequests.show(projectPath, prNumber);
+}
 async function getGitlabRepoDefaultBranch(repoUrl, options) {
   const api2 = getGitBeaker({
     url: repoUrl,
@@ -1938,11 +1982,6 @@ async function getGitlabBlameRanges({ ref, gitlabUrl, path: path9 }, options) {
     };
   });
 }
-var GitlabAuthResultZ = z4.object({
-  access_token: z4.string(),
-  token_type: z4.string(),
-  refresh_token: z4.string()
-});
 function initGitlabFetchMock() {
   const globalFetch = global.fetch;
   function myFetch(input, init) {
@@ -1968,77 +2007,77 @@ import os from "os";
 import path3 from "path";
 import { simpleGit as simpleGit2 } from "simple-git";
 import tmp from "tmp";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/features/analysis/scm/scmSubmit/types.ts
-import { z as z5 } from "zod";
-var BaseSubmitToScmMessageZ = z5.object({
-  submitFixRequestId: z5.string().uuid(),
-  fixes: z5.array(
-    z5.object({
-      fixId: z5.string().uuid(),
-      diff: z5.string()
+import { z as z6 } from "zod";
+var BaseSubmitToScmMessageZ = z6.object({
+  submitFixRequestId: z6.string().uuid(),
+  fixes: z6.array(
+    z6.object({
+      fixId: z6.string().uuid(),
+      diff: z6.string()
     })
   ),
-  commitHash: z5.string(),
-  repoUrl: z5.string()
+  commitHash: z6.string(),
+  repoUrl: z6.string()
 });
 var submitToScmMessageType = {
   commitToSameBranch: "commitToSameBranch",
   submitFixesForDifferentBranch: "submitFixesForDifferentBranch"
 };
 var CommitToSameBranchParamsZ = BaseSubmitToScmMessageZ.merge(
-  z5.object({
-    type: z5.literal(submitToScmMessageType.commitToSameBranch),
-    branch: z5.string(),
-    commitMessage: z5.string(),
-    commitDescription: z5.string().nullish(),
-    githubCommentId: z5.number().nullish()
+  z6.object({
+    type: z6.literal(submitToScmMessageType.commitToSameBranch),
+    branch: z6.string(),
+    commitMessage: z6.string(),
+    commitDescription: z6.string().nullish(),
+    githubCommentId: z6.number().nullish()
   })
 );
-var SubmitFixesToDifferentBranchParamsZ = z5.object({
-  type: z5.literal(submitToScmMessageType.submitFixesForDifferentBranch),
-  submitBranch: z5.string(),
-  baseBranch: z5.string()
+var SubmitFixesToDifferentBranchParamsZ = z6.object({
+  type: z6.literal(submitToScmMessageType.submitFixesForDifferentBranch),
+  submitBranch: z6.string(),
+  baseBranch: z6.string()
 }).merge(BaseSubmitToScmMessageZ);
-var SubmitFixesMessageZ = z5.union([
+var SubmitFixesMessageZ = z6.union([
   CommitToSameBranchParamsZ,
   SubmitFixesToDifferentBranchParamsZ
 ]);
-var FixResponseArrayZ = z5.array(
-  z5.object({
-    fixId: z5.string().uuid()
+var FixResponseArrayZ = z6.array(
+  z6.object({
+    fixId: z6.string().uuid()
   })
 );
-var SubmitFixesBaseResponseMessageZ = z5.object({
-  submitFixRequestId: z5.string().uuid(),
-  submitBranches: z5.array(
-    z5.object({
-      branchName: z5.string(),
+var SubmitFixesBaseResponseMessageZ = z6.object({
+  submitFixRequestId: z6.string().uuid(),
+  submitBranches: z6.array(
+    z6.object({
+      branchName: z6.string(),
       fixes: FixResponseArrayZ
     })
   ),
-  error: z5.object({
-    type: z5.enum([
+  error: z6.object({
+    type: z6.enum([
       "InitialRepoAccessError",
       "PushBranchError",
       "UnknownError"
     ]),
-    info: z5.object({
-      message: z5.string(),
-      pushBranchName: z5.string().optional()
+    info: z6.object({
+      message: z6.string(),
+      pushBranchName: z6.string().optional()
     })
   }).optional()
 });
-var SubmitFixesToSameBranchResponseMessageZ = z5.object({
-  type: z5.literal(submitToScmMessageType.commitToSameBranch),
-  githubCommentId: z5.number().nullish()
+var SubmitFixesToSameBranchResponseMessageZ = z6.object({
+  type: z6.literal(submitToScmMessageType.commitToSameBranch),
+  githubCommentId: z6.number().nullish()
 }).merge(SubmitFixesBaseResponseMessageZ);
-var SubmitFixesToDifferentBranchResponseMessageZ = z5.object({
-  type: z5.literal(submitToScmMessageType.submitFixesForDifferentBranch),
-  githubCommentId: z5.number().optional()
+var SubmitFixesToDifferentBranchResponseMessageZ = z6.object({
+  type: z6.literal(submitToScmMessageType.submitFixesForDifferentBranch),
+  githubCommentId: z6.number().optional()
 }).merge(SubmitFixesBaseResponseMessageZ);
-var SubmitFixesResponseMessageZ = z5.discriminatedUnion("type", [
+var SubmitFixesResponseMessageZ = z6.discriminatedUnion("type", [
   SubmitFixesToSameBranchResponseMessageZ,
   SubmitFixesToDifferentBranchResponseMessageZ
 ]);
@@ -2056,7 +2095,7 @@ var isValidBranchName = async (branchName) => {
     return false;
   }
 };
-var FixesZ = z6.array(z6.object({ fixId: z6.string(), diff: z6.string() })).nonempty();
+var FixesZ = z7.array(z7.object({ fixId: z7.string(), diff: z7.string() })).nonempty();
 
 // src/features/analysis/scm/scm.ts
 function getCloudScmLibTypeFromUrl(url) {
@@ -2276,6 +2315,14 @@ var SCMLib = class {
     }
     return new StubSCMLib(trimmedUrl, void 0, void 0);
   }
+  _validateAccessTokenAndUrl() {
+    if (!this.accessToken) {
+      throw new InvalidAccessTokenError("no access token");
+    }
+    if (!this.url) {
+      throw new InvalidRepoUrlError("no url");
+    }
+  }
 };
 var AdoSCMLib = class extends SCMLib {
   updatePrComment(_params, _oktokit) {
@@ -2442,8 +2489,9 @@ var AdoSCMLib = class extends SCMLib {
       accessToken: this.accessToken
     });
   }
-  getPr() {
-    throw new Error("Method not implemented.");
+  getPrUrl(prNumber) {
+    this._validateAccessTokenAndUrl();
+    return Promise.resolve(getAdoPrUrl({ prNumber, url: this.url }));
   }
   postGeneralPrComment() {
     throw new Error("Method not implemented.");
@@ -2628,8 +2676,14 @@ var GitlabSCMLib = class extends SCMLib {
   updatePrComment(_params, _oktokit) {
     throw new Error("updatePrComment not implemented.");
   }
-  getPr() {
-    throw new Error("Method not implemented.");
+  async getPrUrl(prNumber) {
+    this._validateAccessTokenAndUrl();
+    const res = await getGitlabMergeRequest({
+      url: this.url,
+      prNumber,
+      accessToken: this.accessToken
+    });
+    return res.web_url;
   }
   postGeneralPrComment() {
     throw new Error("Method not implemented.");
@@ -2774,7 +2828,7 @@ var GithubSCMLib = class extends SCMLib {
       owner,
       repo
     });
-    return z7.string().parse(prRes.data);
+    return z8.string().parse(prRes.data);
   }
   async getRepoList(_scmOrg) {
     if (!this.accessToken) {
@@ -2896,17 +2950,18 @@ var GithubSCMLib = class extends SCMLib {
       githubAuthToken: this.accessToken
     });
   }
-  async getPr(prNumber) {
+  async getPrUrl(prNumber) {
     if (!this.url || !this.oktokit) {
       console.error("no url");
       throw new Error("no url");
     }
     const { owner, repo } = parseGithubOwnerAndRepo(this.url);
-    return getPr(this.oktokit, {
+    const getPrRes = await getPr(this.oktokit, {
       owner,
       repo,
       pull_number: prNumber
     });
+    return getPrRes.data.html_url;
   }
   async postGeneralPrComment(params, auth) {
     const { prNumber, body } = params;
@@ -3032,7 +3087,7 @@ var StubSCMLib = class extends SCMLib {
     console.error("updatePrComment() not implemented");
     throw new Error("updatePrComment() not implemented");
   }
-  async getPr() {
+  async getPrUrl(_prNumber) {
     console.error("getPr() not implemented");
     throw new Error("getPr() not implemented");
   }
@@ -3052,22 +3107,22 @@ function removeTrailingSlash3(str) {
   return str.trim().replace(/\/+$/, "");
 }
 async function _getOrgsForOauthToken({ oauthToken }) {
-  const profileZ = z8.object({
-    displayName: z8.string(),
-    publicAlias: z8.string().min(1),
-    emailAddress: z8.string(),
-    coreRevision: z8.number(),
-    timeStamp: z8.string(),
-    id: z8.string(),
-    revision: z8.number()
+  const profileZ = z9.object({
+    displayName: z9.string(),
+    publicAlias: z9.string().min(1),
+    emailAddress: z9.string(),
+    coreRevision: z9.number(),
+    timeStamp: z9.string(),
+    id: z9.string(),
+    revision: z9.number()
   });
-  const accountsZ = z8.object({
-    count: z8.number(),
-    value: z8.array(
-      z8.object({
-        accountId: z8.string(),
-        accountUri: z8.string(),
-        accountName: z8.string()
+  const accountsZ = z9.object({
+    count: z9.number(),
+    value: z9.array(
+      z9.object({
+        accountId: z9.string(),
+        accountUri: z9.string(),
+        accountName: z9.string()
       })
     )
   });
@@ -3298,6 +3353,12 @@ async function getAdoRepoList({
   }, []);
   return repos;
 }
+function getAdoPrUrl({
+  url,
+  prNumber
+}) {
+  return `${url}/pullrequest/${prNumber}`;
+}
 function getAdoDownloadUrl({
   repoUrl,
   branch
@@ -3491,10 +3552,10 @@ function parseAdoOwnerAndRepo(adoUrl) {
 async function getAdoBlameRanges() {
   return [];
 }
-var AdoAuthResultZ = z8.object({
-  access_token: z8.string().min(1),
-  token_type: z8.string().min(1),
-  refresh_token: z8.string().min(1)
+var AdoAuthResultZ = z9.object({
+  access_token: z9.string().min(1),
+  token_type: z9.string().min(1),
+  refresh_token: z9.string().min(1)
 });
 
 // src/features/analysis/scm/constants.ts
@@ -3647,8 +3708,42 @@ function calculateRanges(integers) {
   return ranges;
 }
 
+// src/features/analysis/utils/send_report.ts
+import Debug4 from "debug";
+var debug4 = Debug4("mobbdev:index");
+async function sendReport({
+  spinner,
+  submitVulnerabilityReportVariables,
+  gqlClient
+}) {
+  try {
+    const sumbitRes = await gqlClient.submitVulnerabilityReport(
+      submitVulnerabilityReportVariables
+    );
+    if (sumbitRes.submitVulnerabilityReport.__typename !== "VulnerabilityReport") {
+      debug4("error submit vul report %s", sumbitRes);
+      throw new Error("\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed");
+    }
+    spinner.update({ text: progressMassages.processingVulnerabilityReport });
+    await gqlClient.subscribeToAnalysis({
+      subscribeToAnalysisParams: {
+        analysisId: sumbitRes.submitVulnerabilityReport.fixReportId
+      },
+      callback: () => spinner.update({
+        text: "\u2699\uFE0F Vulnerability report proccessed successfuly"
+      }),
+      callbackStates: ["Digested", "Finished"],
+      timeoutInMs: VUL_REPORT_DIGEST_TIMEOUT_MS
+    });
+    return sumbitRes;
+  } catch (e) {
+    spinner.error({ text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed" });
+    throw e;
+  }
+}
+
 // src/features/analysis/handle_finished_analysis.ts
-var debug4 = Debug4("mobbdev:handle-finished-analysis");
+var debug5 = Debug5("mobbdev:handle-finished-analysis");
 var contactUsMarkdown = `For specific requests [contact us](https://mobb.ai/contact) and we'll do the most to answer your need quickly.`;
 var commitFixButton = (commitUrl) => `<a href="${commitUrl}"><img src=${COMMIT_FIX_SVG}></a>`;
 var MobbIconMarkdown = `![image](${MOBB_ICON_IMG})`;
@@ -3675,7 +3770,7 @@ async function getRelevantVulenrabilitiesFromDiff(params) {
     });
     const lineAddedRanges = calculateRanges(fileNumbers);
     const fileFilter = {
-      path: z9.string().parse(file.to),
+      path: z10.string().parse(file.to),
       ranges: lineAddedRanges.map(([startLine, endLine]) => ({
         endLine,
         startLine
@@ -3786,7 +3881,7 @@ async function handleFinishedAnalysis({
           { authToken: githubActionToken }
         );
       } catch (e) {
-        debug4("delete comment failed %s", e);
+        debug5("delete comment failed %s", e);
         return Promise.resolve();
       }
     });
@@ -3801,7 +3896,7 @@ async function handleFinishedAnalysis({
           githubActionOctokit
         );
       } catch (e) {
-        debug4("delete comment failed %s", e);
+        debug5("delete comment failed %s", e);
         return Promise.resolve();
       }
     });
@@ -3882,7 +3977,7 @@ ${fixPageLink}`,
       fixablePrVuls,
       nonFixablePrVuls
     } = prVulenrabilities;
-    debug4({
+    debug5({
       fixablePrVuls,
       nonFixablePrVuls,
       vulnerabilitiesOutsidePr,
@@ -3958,10 +4053,10 @@ ${contactUsMarkdown}`;
 import fs2 from "node:fs";
 import path4 from "node:path";
 import AdmZip from "adm-zip";
-import Debug5 from "debug";
+import Debug6 from "debug";
 import { globby } from "globby";
 import { isBinary } from "istextorbinary";
-var debug5 = Debug5("mobbdev:pack");
+var debug6 = Debug6("mobbdev:pack");
 var MAX_FILE_SIZE = 1024 * 1024 * 5;
 function endsWithAny(str, suffixes) {
   return suffixes.some(function(suffix) {
@@ -3969,37 +4064,37 @@ function endsWithAny(str, suffixes) {
   });
 }
 async function pack(srcDirPath, vulnFiles) {
-  debug5("pack folder %s", srcDirPath);
+  debug6("pack folder %s", srcDirPath);
   const filepaths = await globby("**", {
     gitignore: true,
     onlyFiles: true,
     cwd: srcDirPath,
     followSymbolicLinks: false
   });
-  debug5("files found %d", filepaths.length);
+  debug6("files found %d", filepaths.length);
   const zip = new AdmZip();
-  debug5("compressing files");
+  debug6("compressing files");
   for (const filepath of filepaths) {
     const absFilepath = path4.join(srcDirPath, filepath.toString());
     if (!endsWithAny(
       absFilepath.toString().replaceAll(path4.win32.sep, path4.posix.sep),
       vulnFiles
     )) {
-      debug5("ignoring %s because it is not a vulnerability file", filepath);
+      debug6("ignoring %s because it is not a vulnerability file", filepath);
       continue;
     }
     if (fs2.lstatSync(absFilepath).size > MAX_FILE_SIZE) {
-      debug5("ignoring %s because the size is > 5MB", filepath);
+      debug6("ignoring %s because the size is > 5MB", filepath);
       continue;
     }
     const data = fs2.readFileSync(absFilepath);
     if (isBinary(null, data)) {
-      debug5("ignoring %s because is seems to be a binary file", filepath);
+      debug6("ignoring %s because is seems to be a binary file", filepath);
       continue;
     }
     zip.addFile(filepath.toString(), data);
   }
-  debug5("get zip file buffer");
+  debug6("get zip file buffer");
   return zip.toBuffer();
 }
 
@@ -4074,7 +4169,7 @@ var cxOperatingSystemSupportMessage = `Your operating system does not support ch
 
 // src/utils/child_process.ts
 import cp from "node:child_process";
-import Debug6 from "debug";
+import Debug7 from "debug";
 import * as process2 from "process";
 import supportsColor from "supports-color";
 var { stdout: stdout2 } = supportsColor;
@@ -4093,16 +4188,16 @@ function createSpwan({ args, processPath, name }, options) {
   return createChildProcess({ childProcess: child, name }, options);
 }
 function createChildProcess({ childProcess, name }, options) {
-  const debug10 = Debug6(`mobbdev:${name}`);
+  const debug11 = Debug7(`mobbdev:${name}`);
   const { display } = options;
   return new Promise((resolve, reject) => {
     let out = "";
     const onData = (chunk) => {
-      debug10(`chunk received from ${name} std ${chunk}`);
+      debug11(`chunk received from ${name} std ${chunk}`);
       out += chunk;
     };
     if (!childProcess || !childProcess?.stdout || !childProcess?.stderr) {
-      debug10(`unable to fork ${name}`);
+      debug11(`unable to fork ${name}`);
       reject(new Error(`unable to fork ${name}`));
     }
     childProcess.stdout?.on("data", onData);
@@ -4112,11 +4207,11 @@ function createChildProcess({ childProcess, name }, options) {
       childProcess.stderr?.pipe(process2.stderr);
     }
     childProcess.on("exit", (code) => {
-      debug10(`${name} exit code ${code}`);
+      debug11(`${name} exit code ${code}`);
       resolve({ message: out, code });
     });
     childProcess.on("error", (err) => {
-      debug10(`${name} error %o`, err);
+      debug11(`${name} error %o`, err);
       reject(err);
     });
   });
@@ -4124,12 +4219,12 @@ function createChildProcess({ childProcess, name }, options) {
 
 // src/features/analysis/scanners/checkmarx.ts
 import chalk2 from "chalk";
-import Debug7 from "debug";
+import Debug8 from "debug";
 import { existsSync } from "fs";
 import { createSpinner as createSpinner2 } from "nanospinner";
 import { type } from "os";
 import path5 from "path";
-var debug6 = Debug7("mobbdev:checkmarx");
+var debug7 = Debug8("mobbdev:checkmarx");
 var require2 = createRequire(import.meta.url);
 var getCheckmarxPath = () => {
   const os3 = type();
@@ -4170,14 +4265,14 @@ function validateCheckmarxInstallation() {
   existsSync(getCheckmarxPath());
 }
 async function forkCheckmarx(args, { display }) {
-  debug6("fork checkmarx with args %o %s", args.join(" "), display);
+  debug7("fork checkmarx with args %o %s", args.join(" "), display);
   return createSpwan(
     { args, processPath: getCheckmarxPath(), name: "checkmarx" },
     { display }
   );
 }
 async function getCheckmarxReport({ reportPath, repositoryRoot, branch, projectName }, { skipPrompts = false }) {
-  debug6("get checkmarx report start %s %s", reportPath, repositoryRoot);
+  debug7("get checkmarx report start %s %s", reportPath, repositoryRoot);
   const { code: loginCode } = await forkCheckmarx(VALIDATE_COMMAND, {
     display: false
   });
@@ -4245,23 +4340,23 @@ async function validateCheckamxCredentials() {
 // src/features/analysis/scanners/snyk.ts
 import { createRequire as createRequire2 } from "node:module";
 import chalk3 from "chalk";
-import Debug8 from "debug";
+import Debug9 from "debug";
 import { createSpinner as createSpinner3 } from "nanospinner";
 import open from "open";
-var debug7 = Debug8("mobbdev:snyk");
+var debug8 = Debug9("mobbdev:snyk");
 var require3 = createRequire2(import.meta.url);
 var SNYK_PATH = require3.resolve("snyk/bin/snyk");
 var SNYK_ARTICLE_URL = "https://docs.snyk.io/scan-application-code/snyk-code/getting-started-with-snyk-code/activating-snyk-code-using-the-web-ui/step-1-enabling-the-snyk-code-option";
-debug7("snyk executable path %s", SNYK_PATH);
+debug8("snyk executable path %s", SNYK_PATH);
 async function forkSnyk(args, { display }) {
-  debug7("fork snyk with args %o %s", args, display);
+  debug8("fork snyk with args %o %s", args, display);
   return createFork(
     { args, processPath: SNYK_PATH, name: "checkmarx" },
     { display }
   );
 }
 async function getSnykReport(reportPath, repoRoot, { skipPrompts = false }) {
-  debug7("get snyk report start %s %s", reportPath, repoRoot);
+  debug8("get snyk report start %s %s", reportPath, repoRoot);
   const config4 = await forkSnyk(["config"], { display: false });
   const { message: configMessage } = config4;
   if (!configMessage.includes("api: ")) {
@@ -4275,7 +4370,7 @@ async function getSnykReport(reportPath, repoRoot, { skipPrompts = false }) {
     snykLoginSpinner.update({
       text: "\u{1F513} Waiting for Snyk login to complete"
     });
-    debug7("no token in the config %s", config4);
+    debug8("no token in the config %s", config4);
     await forkSnyk(["auth"], { display: true });
     snykLoginSpinner.success({ text: "\u{1F513} Login to Snyk Successful" });
   }
@@ -4287,12 +4382,12 @@ async function getSnykReport(reportPath, repoRoot, { skipPrompts = false }) {
   if (scanOutput.includes(
     "Snyk Code is not supported for org: enable in Settings > Snyk Code"
   )) {
-    debug7("snyk code is not enabled %s", scanOutput);
+    debug8("snyk code is not enabled %s", scanOutput);
     snykSpinner.error({ text: "\u{1F50D} Snyk configuration needed" });
     const answer = await snykArticlePrompt();
-    debug7("answer %s", answer);
+    debug8("answer %s", answer);
     if (answer) {
-      debug7("opening the browser");
+      debug8("opening the browser");
       await open(SNYK_ARTICLE_URL);
     }
     console.log(
@@ -4307,18 +4402,18 @@ async function getSnykReport(reportPath, repoRoot, { skipPrompts = false }) {
 }
 
 // src/features/analysis/upload-file.ts
-import Debug9 from "debug";
+import Debug10 from "debug";
 import fetch2, { File, fileFrom, FormData } from "node-fetch";
-var debug8 = Debug9("mobbdev:upload-file");
+var debug9 = Debug10("mobbdev:upload-file");
 async function uploadFile({
   file,
   url,
   uploadKey,
   uploadFields
 }) {
-  debug8("upload file start %s", url);
-  debug8("upload fields %o", uploadFields);
-  debug8("upload key %s", uploadKey);
+  debug9("upload file start %s", url);
+  debug9("upload fields %o", uploadFields);
+  debug9("upload key %s", uploadKey);
   const form = new FormData();
   Object.entries(uploadFields).forEach(([key, value]) => {
     form.append(key, value);
@@ -4327,10 +4422,10 @@ async function uploadFile({
     form.append("key", uploadKey);
   }
   if (typeof file === "string") {
-    debug8("upload file from path %s", file);
+    debug9("upload file from path %s", file);
     form.append("file", await fileFrom(file));
   } else {
-    debug8("upload file from buffer");
+    debug9("upload file from buffer");
     form.append("file", new File([file], "file"));
   }
   const response = await fetch2(url, {
@@ -4338,10 +4433,10 @@ async function uploadFile({
     body: form
   });
   if (!response.ok) {
-    debug8("error from S3 %s %s", response.body, response.status);
+    debug9("error from S3 %s %s", response.body, response.status);
     throw new Error(`Failed to upload the file: ${response.status}`);
   }
-  debug8("upload file done");
+  debug9("upload file done");
 }
 
 // src/features/analysis/index.ts
@@ -4356,9 +4451,9 @@ async function downloadRepo({
 }) {
   const { createSpinner: createSpinner4 } = Spinner2({ ci });
   const repoSpinner = createSpinner4("\u{1F4BE} Downloading Repo").start();
-  debug9("download repo %s %s %s", repoUrl, dirname);
+  debug10("download repo %s %s %s", repoUrl, dirname);
   const zipFilePath = path6.join(dirname, "repo.zip");
-  debug9("download URL: %s auth headers: %o", downloadUrl, authHeaders);
+  debug10("download URL: %s auth headers: %o", downloadUrl, authHeaders);
   const response = await fetch3(downloadUrl, {
     method: "GET",
     headers: {
@@ -4366,7 +4461,7 @@ async function downloadRepo({
     }
   });
   if (!response.ok) {
-    debug9("SCM zipball request failed %s %s", response.body, response.status);
+    debug10("SCM zipball request failed %s %s", response.body, response.status);
     repoSpinner.error({ text: "\u{1F4BE} Repo download failed" });
     throw new Error(`Can't access ${chalk4.bold(repoUrl)}`);
   }
@@ -4380,7 +4475,7 @@ async function downloadRepo({
   if (!repoRoot) {
     throw new Error("Repo root not found");
   }
-  debug9("repo root %s", repoRoot);
+  debug10("repo root %s", repoRoot);
   repoSpinner.success({ text: "\u{1F4BE} Repo downloaded successfully" });
   return path6.join(dirname, repoRoot);
 }
@@ -4397,7 +4492,7 @@ var getReportUrl = ({
   projectId,
   fixReportId
 }) => `${WEB_APP_URL}/organization/${organizationId}/project/${projectId}/report/${fixReportId}`;
-var debug9 = Debug10("mobbdev:index");
+var debug10 = Debug11("mobbdev:index");
 var packageJson = JSON.parse(
   fs3.readFileSync(path6.join(getDirName2(), "../package.json"), "utf8")
 );
@@ -4407,7 +4502,7 @@ if (!semver.satisfies(process.version, packageJson.engines.node)) {
   );
 }
 var config2 = new Configstore(packageJson.name, { apiToken: "" });
-debug9("config %o", config2);
+debug10("config %o", config2);
 async function runAnalysis(params, options) {
   try {
     await _scan(
@@ -4463,7 +4558,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
     githubToken: githubActionToken,
     command
   } = params;
-  debug9("start %s %s", dirname, repo);
+  debug10("start %s %s", dirname, repo);
   const { createSpinner: createSpinner4 } = Spinner2({ ci });
   skipPrompts = skipPrompts || ci;
   let gqlClient = new GQLClient({
@@ -4528,9 +4623,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
   });
   const reference = ref ?? await scm.getRepoDefaultBranch();
   const { sha } = await scm.getReferenceData(reference);
-  debug9("org id %s", organizationId);
-  debug9("project id %s", projectId);
-  debug9("default branch %s", reference);
+  debug10("org id %s", organizationId);
+  debug10("project id %s", projectId);
+  debug10("default branch %s", reference);
   const repositoryRoot = await downloadRepo({
     repoUrl: repo,
     dirname,
@@ -4558,44 +4653,39 @@ async function _scan(params, { skipPrompts = false } = {}) {
   }
   uploadReportSpinner.success({ text: "\u{1F4C1} Report uploaded successfully" });
   const mobbSpinner = createSpinner4("\u{1F575}\uFE0F\u200D\u2642\uFE0F Initiating Mobb analysis").start();
-  const sendReportRes = await sendReport();
+  const sendReportRes = await sendReport({
+    gqlClient,
+    spinner: mobbSpinner,
+    submitVulnerabilityReportVariables: {
+      fixReportId: reportUploadInfo.fixReportId,
+      repoUrl: z11.string().parse(repo),
+      reference,
+      projectId,
+      vulnerabilityReportFileName: "report.json",
+      sha,
+      experimentalEnabled,
+      pullRequest: params.pullRequest
+    }
+  });
   if (command === "review") {
-    await gqlClient.subscribeToAnalysis(
-      { analysisId: sendReportRes.submitVulnerabilityReport.fixReportId },
-      (analysisId) => handleFinishedAnalysis({
+    await gqlClient.subscribeToAnalysis({
+      subscribeToAnalysisParams: {
+        analysisId: sendReportRes.submitVulnerabilityReport.fixReportId
+      },
+      callback: (analysisId) => handleFinishedAnalysis({
         analysisId,
         gqlClient,
         scm,
-        githubActionToken: z10.string().parse(githubActionToken),
-        scanner: z10.nativeEnum(SCANNERS).parse(scanner)
-      })
-    );
+        githubActionToken: z11.string().parse(githubActionToken),
+        scanner: z11.nativeEnum(SCANNERS).parse(scanner)
+      }),
+      callbackStates: ["Finished"]
+    });
   }
   mobbSpinner.success({
     text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
   });
   await askToOpenAnalysis();
-  async function sendReport() {
-    try {
-      const sumbitRes = await gqlClient.submitVulnerabilityReport({
-        fixReportId: reportUploadInfo.fixReportId,
-        repoUrl: z10.string().parse(repo),
-        reference,
-        projectId,
-        vulnerabilityReportFileName: "report.json",
-        sha,
-        experimentalEnabled,
-        pullRequest: params.pullRequest
-      });
-      if (sumbitRes.submitVulnerabilityReport.__typename !== "VulnerabilityReport") {
-        throw new Error("\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed");
-      }
-      return sumbitRes;
-    } catch (e) {
-      mobbSpinner.error({ text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed" });
-      throw e;
-    }
-  }
   async function getReport(scanner2) {
     const reportPath2 = path6.join(dirname, "report.json");
     switch (scanner2) {
@@ -4671,9 +4761,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
       });
       loginSpinner.spin();
       if (encryptedApiToken) {
-        debug9("encrypted API token received %s", encryptedApiToken);
+        debug10("encrypted API token received %s", encryptedApiToken);
         newApiToken = crypto.privateDecrypt(privateKey, Buffer.from(encryptedApiToken, "base64")).toString("utf-8");
-        debug9("API token decrypted");
+        debug10("API token decrypted");
         break;
       }
       await sleep(LOGIN_CHECK_DELAY);
@@ -4686,7 +4776,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
     }
     gqlClient = new GQLClient({ apiKey: newApiToken });
     if (await gqlClient.verifyToken()) {
-      debug9("set api token %s", newApiToken);
+      debug10("set api token %s", newApiToken);
       config2.set("apiToken", newApiToken);
       loginSpinner.success({ text: "\u{1F513} Login to Mobb successful!" });
     } else {
@@ -4749,7 +4839,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
     uploadReportSpinner2.success({
       text: "\u{1F4C1} Uploading Report successful!"
     });
-    const digestSpinner = createSpinner4("\u{1F575}\uFE0F\u200D\u2642\uFE0F Digesting report").start();
+    const digestSpinner = createSpinner4(
+      progressMassages.processingVulnerabilityReport
+    ).start();
     let vulnFiles = [];
     const gitInfo = await getGitInfo(srcPath);
     try {
@@ -4757,12 +4849,19 @@ async function _scan(params, { skipPrompts = false } = {}) {
         fixReportId: reportUploadInfo.fixReportId,
         projectId
       });
-      const finalState = await gqlClient.waitFixReportInit(
-        reportUploadInfo.fixReportId,
-        true
-      );
-      if (finalState !== "Digested") {
-        throw new Error("Digesting report failed");
+      try {
+        await gqlClient.subscribeToAnalysis({
+          subscribeToAnalysisParams: {
+            analysisId: reportUploadInfo.fixReportId
+          },
+          callback: () => digestSpinner.update({
+            text: progressMassages.processingVulnerabilityReportSuccess
+          }),
+          callbackStates: ["Digested", "Finished"],
+          timeoutInMs: VUL_REPORT_DIGEST_TIMEOUT_MS
+        });
+      } catch (e) {
+        throw new Error(progressMassages.processingVulnerabilityReportFailed);
       }
       vulnFiles = await gqlClient.getVulnerabilityReportPaths(
         vulnerabilityReportId
@@ -4772,7 +4871,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
       throw e;
     }
     digestSpinner.success({
-      text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Digesting report successful!"
+      text: progressMassages.processingVulnerabilityReportSuccess
     });
     const zippingSpinner = createSpinner4("\u{1F4E6} Zipping repo").start();
     const zipBuffer = await pack(srcPath, vulnFiles);
@@ -4792,12 +4891,16 @@ async function _scan(params, { skipPrompts = false } = {}) {
     uploadRepoSpinner.success({ text: "\u{1F4C1} Uploading Repo successful!" });
     const mobbSpinner2 = createSpinner4("\u{1F575}\uFE0F\u200D\u2642\uFE0F Initiating Mobb analysis").start();
     try {
-      await gqlClient.submitVulnerabilityReport({
-        fixReportId: reportUploadInfo.fixReportId,
-        projectId,
-        repoUrl: repo || gitInfo.repoUrl,
-        reference: gitInfo.reference,
-        sha: commitHash || gitInfo.hash
+      await sendReport({
+        gqlClient,
+        spinner: mobbSpinner2,
+        submitVulnerabilityReportVariables: {
+          fixReportId: reportUploadInfo.fixReportId,
+          projectId,
+          repoUrl: repo || gitInfo.repoUrl || getTopLevelDirName(srcPath),
+          reference: gitInfo.reference || "no-branch",
+          sha: commitHash || gitInfo.hash || "0123456789abcdef"
+        }
       });
     } catch (e) {
       mobbSpinner2.error({ text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed" });
@@ -4998,7 +5101,7 @@ var scmTokenOption = {
 // src/args/validation.ts
 import chalk6 from "chalk";
 import path8 from "path";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function throwRepoUrlErrorMessage({
   error,
   repoUrl,
@@ -5015,7 +5118,7 @@ Example:
   )}`;
   throw new CliError(formattedErrorMessage);
 }
-var UrlZ = z11.string({
+var UrlZ = z12.string({
   invalid_type_error: "is not a valid GitHub / GitLab / ADO URL"
 }).refine((data) => !!sanityRepoURL(data), {
   message: "is not a valid GitHub / GitLab / ADO URL"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "0.0.90",
+  "version": "0.0.93",
   "description": "Automated secure code remediation tool",
   "repository": "https://github.com/mobb-dev/bugsy",
   "main": "dist/index.js",