mobbdev 1.0.164 → 1.0.168

package/dist/index.mjs

@@ -968,6 +968,7 @@ var init_GitService = __esm({
           );
           const fileSet = /* @__PURE__ */ new Set();
           let commitsProcessed = 0;
+          const consideredFiles = [];
           for (const file of currentChanges.files) {
             if (fileSet.size >= maxFiles) {
               break;
@@ -1026,7 +1027,7 @@ var init_GitService = __esm({
                     path2.join(gitRoot, gitRelativePath)
                   );
                 }
-                this.log(`[GitService] Considering file: ${adjustedPath}`, "debug");
+                consideredFiles.push(adjustedPath);
                 if (!fileSet.has(adjustedPath) && await FileUtils.shouldPackFile(
                   path2.join(gitRoot, gitRelativePath)
                 ) && !adjustedPath.startsWith("..")) {
@@ -1044,6 +1045,13 @@ var init_GitService = __esm({
             }
           }
           const files = Array.from(fileSet);
+          if (consideredFiles.length > 0) {
+            this.log(
+              `[GitService] Considered ${consideredFiles.length} files during recent file search`,
+              "debug",
+              { consideredFiles }
+            );
+          }
           this.log("[GitService] Recently changed files retrieved", "info", {
             fileCount: files.length,
             commitsProcessed,
@@ -1586,6 +1594,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["ErroneousStringCompare"] = "ERRONEOUS_STRING_COMPARE";
   IssueType_Enum2["ErrorCondtionWithoutAction"] = "ERROR_CONDTION_WITHOUT_ACTION";
   IssueType_Enum2["FrameableLoginPage"] = "FRAMEABLE_LOGIN_PAGE";
+  IssueType_Enum2["FunctionCallWithoutParentheses"] = "FUNCTION_CALL_WITHOUT_PARENTHESES";
   IssueType_Enum2["GhActionsShellInjection"] = "GH_ACTIONS_SHELL_INJECTION";
   IssueType_Enum2["GraphqlDepthLimit"] = "GRAPHQL_DEPTH_LIMIT";
   IssueType_Enum2["HardcodedDomainInHtml"] = "HARDCODED_DOMAIN_IN_HTML";
@@ -1655,6 +1664,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["RegexMissingTimeout"] = "REGEX_MISSING_TIMEOUT";
   IssueType_Enum2["RequestParametersBoundViaInput"] = "REQUEST_PARAMETERS_BOUND_VIA_INPUT";
   IssueType_Enum2["ReturnShouldNotBeInvariant"] = "RETURN_SHOULD_NOT_BE_INVARIANT";
+  IssueType_Enum2["SpringDefaultPermit"] = "SPRING_DEFAULT_PERMIT";
   IssueType_Enum2["SqlInjection"] = "SQL_Injection";
   IssueType_Enum2["Ssrf"] = "SSRF";
   IssueType_Enum2["StringFormatMisuse"] = "STRING_FORMAT_MISUSE";
@@ -1705,6 +1715,16 @@ var Project_Role_Type_Enum = /* @__PURE__ */ ((Project_Role_Type_Enum2) => {
   Project_Role_Type_Enum2["Writer"] = "writer";
   return Project_Role_Type_Enum2;
 })(Project_Role_Type_Enum || {});
+var Vulnerability_Report_Issue_Category_Enum = /* @__PURE__ */ ((Vulnerability_Report_Issue_Category_Enum2) => {
+  Vulnerability_Report_Issue_Category_Enum2["FalsePositive"] = "FalsePositive";
+  Vulnerability_Report_Issue_Category_Enum2["Filtered"] = "Filtered";
+  Vulnerability_Report_Issue_Category_Enum2["Fixable"] = "Fixable";
+  Vulnerability_Report_Issue_Category_Enum2["Irrelevant"] = "Irrelevant";
+  Vulnerability_Report_Issue_Category_Enum2["NoFix"] = "NoFix";
+  Vulnerability_Report_Issue_Category_Enum2["Pending"] = "Pending";
+  Vulnerability_Report_Issue_Category_Enum2["Unsupported"] = "Unsupported";
+  return Vulnerability_Report_Issue_Category_Enum2;
+})(Vulnerability_Report_Issue_Category_Enum || {});
 var Vulnerability_Report_Issue_State_Enum = /* @__PURE__ */ ((Vulnerability_Report_Issue_State_Enum2) => {
   Vulnerability_Report_Issue_State_Enum2["Digested"] = "Digested";
   Vulnerability_Report_Issue_State_Enum2["Error"] = "Error";
@@ -1791,35 +1811,35 @@ var FixReportSummaryFieldsFragmentDoc = `
   }
   issueTypes
   CRITICAL: fixes_aggregate(
-    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: "Fixable"}}}, {severityText: {_eq: "critical"}}]}
+    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: Fixable}}}, {severityText: {_eq: "critical"}}]}
   ) {
     aggregate {
       count
     }
   }
   HIGH: fixes_aggregate(
-    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: "Fixable"}}}, {severityText: {_eq: "high"}}]}
+    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: Fixable}}}, {severityText: {_eq: "high"}}]}
   ) {
     aggregate {
       count
     }
   }
   MEDIUM: fixes_aggregate(
-    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: "Fixable"}}}, {severityText: {_eq: "medium"}}]}
+    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: Fixable}}}, {severityText: {_eq: "medium"}}]}
   ) {
     aggregate {
       count
     }
   }
   LOW: fixes_aggregate(
-    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: "Fixable"}}}, {severityText: {_eq: "low"}}]}
+    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: Fixable}}}, {severityText: {_eq: "low"}}]}
   ) {
     aggregate {
       count
     }
   }
   fixes(
-    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: "Fixable"}}}, {_or: [{gitBlameLogin: {_is_null: true}}, {_not: {gitBlameLogin: {_ilike: $currentUserEmail}}}]}, $filters]}
+    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: Fixable}}}, {_or: [{gitBlameLogin: {_is_null: true}}, {_not: {gitBlameLogin: {_ilike: $currentUserEmail}}}]}, $filters]}
     order_by: {severityValue: desc}
     limit: $limit
     offset: $offset
@@ -1827,7 +1847,7 @@ var FixReportSummaryFieldsFragmentDoc = `
     ...FixDetails
   }
   userFixes: fixes(
-    where: {_and: [{gitBlameLogin: {_ilike: $currentUserEmail}}, {vulnerabilityReportIssues: {category: {_eq: "Fixable"}}}, $filters]}
+    where: {_and: [{gitBlameLogin: {_ilike: $currentUserEmail}}, {vulnerabilityReportIssues: {category: {_eq: Fixable}}}, $filters]}
     order_by: {severityValue: desc}
     limit: $limit
     offset: $offset
@@ -1835,7 +1855,7 @@ var FixReportSummaryFieldsFragmentDoc = `
     ...FixDetails
   }
   filteredFixesCount: fixes_aggregate(
-    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: "Fixable"}}}, $filters]}
+    where: {_and: [{vulnerabilityReportIssues: {category: {_eq: Fixable}}}, $filters]}
   ) {
     aggregate {
       count
@@ -1855,7 +1875,7 @@ var FixReportSummaryFieldsFragmentDoc = `
       }
     }
     notFixableVulnerabilityReportIssuesCount: vulnerabilityReportIssues_aggregate(
-      where: {category: {_neq: "Fixable"}}
+      where: {category: {_neq: Fixable}}
     ) {
       aggregate {
         count
@@ -2064,7 +2084,7 @@ var GetVulByNodesMetadataDocument = `
     where: {id: {_eq: $vulnerabilityReportId}}
   ) {
     vulnerabilityReportIssues(
-      where: {fixId: {_is_null: true}, _or: [{category: {_eq: "Irrelevant"}}, {category: {_eq: "FalsePositive"}}, {category: {_eq: "Filtered"}}]}
+      where: {fixId: {_is_null: true}, category: {_in: [Irrelevant, FalsePositive, Filtered]}}
     ) {
       id
       safeIssueType
@@ -2729,7 +2749,9 @@ var fixDetailsData = {
   ["USE_TIMEOUT" /* UseTimeout */]: void 0,
   ["USELESS_IF_BODY" /* UselessIfBody */]: void 0,
   ["MISSING_TEMPLATE_STRING_INDICATOR" /* MissingTemplateStringIndicator */]: void 0,
-  ["NO_ASSERT" /* NoAssert */]: void 0
+  ["NO_ASSERT" /* NoAssert */]: void 0,
+  ["FUNCTION_CALL_WITHOUT_PARENTHESES" /* FunctionCallWithoutParentheses */]: void 0,
+  ["SPRING_DEFAULT_PERMIT" /* SpringDefaultPermit */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/getIssueType.ts
@@ -2863,7 +2885,9 @@ var issueTypeMap = {
   ["USE_RAISE_FOR_STATUS" /* UseRaiseForStatus */]: "Use Raise For Status",
   ["USE_TIMEOUT" /* UseTimeout */]: "Use Timeout",
   ["USELESS_IF_BODY" /* UselessIfBody */]: "Useless If Body",
-  ["NO_ASSERT" /* NoAssert */]: "No Assert"
+  ["NO_ASSERT" /* NoAssert */]: "No Assert",
+  ["FUNCTION_CALL_WITHOUT_PARENTHESES" /* FunctionCallWithoutParentheses */]: "Function Call Without Parentheses",
+  ["SPRING_DEFAULT_PERMIT" /* SpringDefaultPermit */]: "Spring Default Permit"
 };
 var issueTypeZ = z.nativeEnum(IssueType_Enum);
 var getIssueTypeFriendlyString = (issueType) => {
@@ -4813,24 +4837,6 @@ var FixPageFixReportZ = z8.object({
 
 // src/features/analysis/scm/shared/src/types/issue.ts
 var MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES = 1e5;
-var CATEGORY = {
-  NoFix: "NoFix",
-  Unsupported: "Unsupported",
-  Irrelevant: "Irrelevant",
-  FalsePositive: "FalsePositive",
-  Fixable: "Fixable",
-  Filtered: "Filtered",
-  Pending: "Pending"
-};
-var ValidCategoriesZ = z9.union([
-  z9.literal(CATEGORY.NoFix),
-  z9.literal(CATEGORY.Unsupported),
-  z9.literal(CATEGORY.Irrelevant),
-  z9.literal(CATEGORY.FalsePositive),
-  z9.literal(CATEGORY.Fixable),
-  z9.literal(CATEGORY.Filtered),
-  z9.literal(CATEGORY.Pending)
-]);
 var VulnerabilityReportIssueSharedStateZ = z9.object({
   id: z9.string().uuid(),
   isArchived: z9.boolean(),
@@ -4847,7 +4853,7 @@ var BaseIssuePartsZ = z9.object({
   safeIssueLanguage: z9.string(),
   createdAt: z9.string(),
   parsedSeverity: ParsedSeverityZ,
-  category: ValidCategoriesZ,
+  category: z9.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
   extraData: z9.object({
     missing_files: z9.string().array().nullish(),
     error_files: z9.string().array().nullish()
@@ -4901,13 +4907,13 @@ var FalsePositivePartsZ = z9.object({
 });
 var IssuePartsWithFixZ = BaseIssuePartsZ.merge(
   z9.object({
-    category: z9.literal(CATEGORY.Irrelevant),
+    category: z9.literal("Irrelevant" /* Irrelevant */),
     fix: FixPartsForFixScreenZ.nullish()
   })
 );
 var IssuePartsFpZ = BaseIssuePartsZ.merge(
   z9.object({
-    category: z9.literal(CATEGORY.FalsePositive),
+    category: z9.literal("FalsePositive" /* FalsePositive */),
     fpId: z9.string().uuid(),
     getFalsePositive: FalsePositivePartsZ
   })
@@ -4915,11 +4921,11 @@ var IssuePartsFpZ = BaseIssuePartsZ.merge(
 var GeneralIssueZ = BaseIssuePartsZ.merge(
   z9.object({
     category: z9.union([
-      z9.literal(CATEGORY.NoFix),
-      z9.literal(CATEGORY.Unsupported),
-      z9.literal(CATEGORY.Fixable),
-      z9.literal(CATEGORY.Filtered),
-      z9.literal(CATEGORY.Pending)
+      z9.literal("NoFix" /* NoFix */),
+      z9.literal("Unsupported" /* Unsupported */),
+      z9.literal("Fixable" /* Fixable */),
+      z9.literal("Filtered" /* Filtered */),
+      z9.literal("Pending" /* Pending */)
     ])
   })
 );
@@ -4953,6 +4959,19 @@ var mapCategoryToBucket = {
   Filtered: "irrelevant",
   Pending: "remaining"
 };
+var mapBucketTypeToCategory = {
+  irrelevant: [
+    "FalsePositive" /* FalsePositive */,
+    "Irrelevant" /* Irrelevant */,
+    "Filtered" /* Filtered */
+  ],
+  remaining: [
+    "NoFix" /* NoFix */,
+    "Unsupported" /* Unsupported */,
+    "Pending" /* Pending */
+  ],
+  fixable: ["Fixable" /* Fixable */]
+};
 
 // src/features/analysis/scm/shared/src/types/types.ts
 import { z as z11 } from "zod";
@@ -5082,7 +5101,7 @@ var ReportQueryResultZ = z11.object({
             id: z11.string().uuid(),
             issueType: z11.string(),
             issueLanguage: z11.string(),
-            category: z11.string(),
+            category: z11.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
             sharedState: IssueSharedStateZ2
           })
         )
@@ -5190,7 +5209,7 @@ var ReportFixesQueryFixZ = z11.object({
     })
   ).min(1)
 });
-var VulnerabilityReportIssueZ = z11.object({
+var BaseVulnerabilityReportIssueZ = z11.object({
   id: z11.string().uuid(),
   createdAt: z11.string(),
   state: z11.nativeEnum(Vulnerability_Report_Issue_State_Enum),
@@ -5209,7 +5228,6 @@ var VulnerabilityReportIssueZ = z11.object({
   severity: z11.string(),
   severityValue: z11.number(),
   category: z11.string(),
-  codeNodes: z11.array(z11.object({ path: z11.string() })),
   vulnerabilityReportIssueTags: z11.array(
     z11.object({
       vulnerability_report_issue_tag_value: z11.string()
@@ -5217,6 +5235,18 @@ var VulnerabilityReportIssueZ = z11.object({
   ),
   sharedState: VulnerabilityReportIssueSharedStateZ
 });
+var VulnerabilityReportIssueZ = BaseVulnerabilityReportIssueZ.merge(
+  z11.object({
+    codeNodes: z11.array(z11.object({ path: z11.string() }))
+  })
+);
+var VulnerabilityReportIssueWithCodeFilePathZ = BaseVulnerabilityReportIssueZ.merge(
+  z11.object({
+    codeFilePath: z11.string().nullable(),
+    //TODO: REMOVE THIS once we flush out all the reports that don't have codeFilePath
+    codeNodes: z11.array(z11.object({ path: z11.string() }))
+  })
+);
 var GetReportIssuesQueryZ = z11.object({
   fixReport: z11.object({
     vulnerabilityReport: z11.object({
@@ -5225,7 +5255,9 @@ var GetReportIssuesQueryZ = z11.object({
       vulnerabilityReportIssues_aggregate: z11.object({
         aggregate: z11.object({ count: z11.number() })
       }),
-      vulnerabilityReportIssues: z11.array(VulnerabilityReportIssueZ)
+      vulnerabilityReportIssues: z11.array(
+        VulnerabilityReportIssueWithCodeFilePathZ
+      )
     })
   }).array()
 }).nullish();
@@ -10171,7 +10203,7 @@ var VulnerabilityReportIssueCodeNodeZ = z27.object({
   startLine: z27.number(),
   vulnerabilityReportIssue: z27.object({
     fixId: z27.string(),
-    category: ValidCategoriesZ,
+    category: z27.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
     safeIssueType: z27.string(),
     vulnerabilityReportIssueTags: z27.array(
       z27.object({
@@ -10185,7 +10217,7 @@ var VulnerabilityReportIssueNoFixCodeNodeZ = z27.object({
     z27.object({
       id: z27.string(),
       fixId: z27.string().nullable(),
-      category: ValidCategoriesZ,
+      category: z27.nativeEnum(Vulnerability_Report_Issue_Category_Enum),
       safeIssueType: z27.string(),
       fpId: z27.string().uuid().nullable(),
       codeNodes: z27.array(

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "mobbdev",
-  "version": "1.0.164",
+  "version": "1.0.168",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
-  "main": "dist/index.js",
-  "module": "dist/index.js",
+  "main": "dist/index.mjs",
+  "module": "dist/index.mjs",
   "scripts": {
     "clean": "rm -rf build",
     "env": "dotenv -e ./.env",
@@ -12,15 +12,15 @@
     "build": "tsc && tsup-node --env.NODE_ENV production",
     "build:dev": "tsup-node --env.NODE_ENV development",
     "increment-version": "./src/scripts/increment-version.sh",
-    "test:mcp": "pnpm run build && vitest run __tests__/mcp/",
+    "test:unit:mcp": "vitest run __tests__/mcp/",
     "test:mcp:watch": "vitest watch __tests__/mcp/",
     "test:mcp:verbose": "pnpm run build && NODE_ENV=test VERBOSE=true vitest run __tests__/mcp/",
-    "test:mcp:integration": "pnpm run build && GIT_PROXY_HOST=http://tinyproxy:8888 API_URL=http://app-api:8080/v1/graphql TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.test.ts -t 'mcp|MCP'",
-    "test:mcp:all": "pnpm run test:mcp && pnpm run test:mcp:integration && cd ./__e2e__ && npm i && npm run test:mcp",
-    "test:unit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/mcp/**'",
+    "test:mcp:all": "pnpm run test:unit:mcp && pnpm run test:integration:mcp && pnpm run test:e2e:mcp",
+    "test:unit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/mcp/**'",
     "test:integration": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.test.ts",
+    "test:integration:mcp": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.mcp.test.ts",
     "test:integration:watch": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest watch run __tests__/integration.test.ts",
-    "test": "pnpm run test:unit && pnpm run test:mcp && pnpm run test:integration",
+    "test": "pnpm run test:unit && pnpm run test:integration",
     "test:ado": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run ado.test",
     "test:github": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run github.test",
     "test:gitlab": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run gitlab.test",
@@ -30,13 +30,14 @@
     "test:watch": "TOKEN=$(../../scripts/login_auth0.sh) vitest",
     "test:integration:proxy": "GIT_PROXY_HOST=http://tinyproxy:8888 HTTP_PROXY=http://localhost:8888 API_URL=http://app-api:8080/v1/graphql TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false integration.test.ts",
     "lint": "eslint --cache --max-warnings 0 --ignore-path .eslintignore --ext .ts,.tsx,.jsx,.graphql .",
+    "lint:fix": "eslint --fix --cache --max-warnings 0 --ignore-path .eslintignore --ext .js,.ts,.tsx,.jsx,.graphql . && prettier --write \"src/**/*.graphql\"",
     "lint:fix:files": "eslint --fix --cache --max-warnings 0 --ignore-path .eslintignore --ext .js,.ts,.tsx,.jsx,.graphql",
     "prepack": "dotenv-vault pull production .env && pnpm build",
     "dev:mcp": "pnpm run build && node dist/index.mjs mcp",
     "debug:mcp": "pnpm run build && node dist/index.mjs mcp --debug",
     "generate": "pnpm run env -- graphql-codegen -r dotenv/config --config client_codegen.ts",
-    "test:e2e": "cd ./__e2e__ && npm i && npm run test && npm run test:mcp",
-    "test:e2e:mcp": "cd ./__e2e__ && npm i && npm run test:mcp"
+    "test:e2e": "cd ./__e2e__ && npm i && npm run test",
+    "test:e2e:mcp": "pnpm run build && cd ./__e2e__ && npm i && npm run test:mcp"
   },
   "bin": {
     "mobbdev": "bin/cli.mjs"