mobbdev 1.0.171 → 1.0.176

package/dist/index.mjs

@@ -32,7 +32,7 @@ var init_env = __esm({
 });
 
 // src/mcp/core/configs.ts
-var MCP_DEFAULT_API_URL, MCP_API_KEY_HEADER_NAME, MCP_LOGIN_MAX_WAIT, MCP_LOGIN_CHECK_DELAY, MCP_VUL_REPORT_DIGEST_TIMEOUT_MS, MCP_MAX_FILE_SIZE, MCP_PERIODIC_CHECK_INTERVAL, MCP_DEFAULT_MAX_FILES_TO_SCAN, MCP_REPORT_ID_EXPIRATION_MS, MCP_TOOLS_BROWSER_COOLDOWN_MS, MCP_DEFAULT_LIMIT, isAutoScan;
+var MCP_DEFAULT_API_URL, MCP_API_KEY_HEADER_NAME, MCP_LOGIN_MAX_WAIT, MCP_LOGIN_CHECK_DELAY, MCP_VUL_REPORT_DIGEST_TIMEOUT_MS, MCP_MAX_FILE_SIZE, MCP_PERIODIC_CHECK_INTERVAL, MCP_DEFAULT_MAX_FILES_TO_SCAN, MCP_REPORT_ID_EXPIRATION_MS, MCP_TOOLS_BROWSER_COOLDOWN_MS, MCP_DEFAULT_LIMIT, isAutoScan, MVS_AUTO_FIX_OVERRIDE, MCP_AUTO_FIX_DEBUG_MODE;
 var init_configs = __esm({
   "src/mcp/core/configs.ts"() {
     "use strict";
@@ -49,6 +49,8 @@ var init_configs = __esm({
     MCP_TOOLS_BROWSER_COOLDOWN_MS = 24 * 60 * 60 * 1e3;
     MCP_DEFAULT_LIMIT = 3;
     isAutoScan = process.env["AUTO_SCAN"] !== "false";
+    MVS_AUTO_FIX_OVERRIDE = process.env["MVS_AUTO_FIX"];
+    MCP_AUTO_FIX_DEBUG_MODE = true;
   }
 });
 
@@ -578,16 +580,16 @@ var init_FileUtils = __esm({
     FileUtils = class {
       // Important project configuration files that should always be included
       static isExcludedFileType(filepath) {
-        const basename = path.basename(filepath).toLowerCase();
-        if (IMPORTANT_PROJECT_FILES.includes(basename)) {
+        const basename2 = path.basename(filepath).toLowerCase();
+        if (IMPORTANT_PROJECT_FILES.includes(basename2)) {
           return false;
         }
         const ext = path.extname(filepath).toLowerCase();
-        const isSupported = SUPPORTED_EXTENSIONS.includes(ext) || SUPPORTED_EXTENSIONS.includes(basename);
+        const isSupported = SUPPORTED_EXTENSIONS.includes(ext) || SUPPORTED_EXTENSIONS.includes(basename2);
         if (!isSupported) {
           return true;
         }
-        if (EXCLUDED_FILE_PATTERNS.some((pattern) => basename.endsWith(pattern))) {
+        if (EXCLUDED_FILE_PATTERNS.some((pattern) => basename2.endsWith(pattern))) {
           return true;
         }
         return false;
@@ -739,6 +741,26 @@ var init_GitService = __esm({
           repositoryPath
         });
       }
+      /**
+       * Checks if the current path is within a git repository
+       * @returns Promise<boolean> True if it's a git repository, false otherwise
+       */
+      async isGitRepository() {
+        try {
+          const isRepo = await this.git.checkIsRepo();
+          if (!isRepo) {
+            this.log("[GitService] Not a git repository", "debug");
+            return false;
+          }
+          await this.git.revparse(["--show-toplevel"]);
+          return true;
+        } catch (error) {
+          this.log("[GitService] Not a git repository", "debug", {
+            error: String(error)
+          });
+          return false;
+        }
+      }
       /**
        * Validates that the path is a valid git repository
        */
@@ -782,9 +804,12 @@ var init_GitService = __esm({
             if (gitRelativePath.startsWith(relativePathFromGitRoot + "/")) {
               return gitRelativePath.substring(relativePathFromGitRoot.length + 1);
             }
+            const safeInput = path2.basename(
+              String(gitRelativePath || "").replace("\0", "").replace(/^(\.\.(\/|\\$))+/, "")
+            );
             return path2.relative(
               this.repositoryPath,
-              path2.join(gitRoot, gitRelativePath)
+              path2.join(gitRoot, safeInput)
             );
           });
           this.log("[GitService] Git status retrieved", "info", {
@@ -1209,6 +1234,83 @@ ${rootContent}`;
         if (!content) return null;
         return ignore().add(content);
       }
+      /**
+       * Gets the git repository root directory path
+       * @returns Absolute path to the git repository root
+       */
+      async getGitRoot() {
+        this.log("[GitService] Getting git repository root", "debug");
+        try {
+          const gitRoot = await this.git.revparse(["--show-toplevel"]);
+          this.log("[GitService] Git root retrieved", "debug", { gitRoot });
+          return gitRoot;
+        } catch (error) {
+          const errorMessage = `Failed to get git repository root: ${error.message}`;
+          this.log(`[GitService] ${errorMessage}`, "error", { error });
+          throw new Error(errorMessage);
+        }
+      }
+      /**
+       * Ensures that a specific entry exists in the .gitignore file
+       * Creates .gitignore if it doesn't exist, adds the entry if not present
+       * @param entry The entry to add to .gitignore (e.g., '.mobb', 'node_modules')
+       * @returns True if entry was added, false if it already existed
+       */
+      async ensureGitignoreEntry(entry) {
+        this.log("[GitService] Ensuring .gitignore entry", "debug", { entry });
+        try {
+          const gitRoot = await this.getGitRoot();
+          const gitignorePath = path2.join(gitRoot, ".gitignore");
+          let gitignoreContent = "";
+          if (fs3.existsSync(gitignorePath)) {
+            gitignoreContent = fs3.readFileSync(gitignorePath, "utf8");
+            this.log("[GitService] .gitignore file exists", "debug");
+          } else {
+            this.log("[GitService] Creating .gitignore file", "info", {
+              gitignorePath
+            });
+          }
+          if (gitignoreContent.includes(entry)) {
+            this.log("[GitService] Entry already exists in .gitignore", "debug", {
+              entry
+            });
+            return false;
+          }
+          this.log("[GitService] Adding entry to .gitignore", "info", { entry });
+          const newLine = gitignoreContent.endsWith("\n") || gitignoreContent === "" ? "" : "\n";
+          const updatedContent = `${gitignoreContent}${newLine}${entry}
+`;
+          fs3.writeFileSync(gitignorePath, updatedContent, "utf8");
+          this.log("[GitService] .gitignore updated successfully", "debug", {
+            entry
+          });
+          return true;
+        } catch (error) {
+          const errorMessage = `Failed to ensure .gitignore entry: ${error.message}`;
+          this.log(`[GitService] ${errorMessage}`, "error", { error, entry });
+          throw new Error(errorMessage);
+        }
+      }
+      /**
+       * Checks if the .gitignore file exists in the repository root
+       * @returns True if .gitignore exists, false otherwise
+       */
+      async gitignoreExists() {
+        this.log("[GitService] Checking if .gitignore exists", "debug");
+        try {
+          const gitRoot = await this.getGitRoot();
+          const gitignorePath = path2.join(gitRoot, ".gitignore");
+          const exists = fs3.existsSync(gitignorePath);
+          this.log("[GitService] .gitignore existence check complete", "debug", {
+            exists
+          });
+          return exists;
+        } catch (error) {
+          const errorMessage = `Failed to check .gitignore existence: ${error.message}`;
+          this.log(`[GitService] ${errorMessage}`, "error", { error });
+          throw new Error(errorMessage);
+        }
+      }
     };
   }
 });
@@ -1570,6 +1672,7 @@ var IssueLanguage_Enum = /* @__PURE__ */ ((IssueLanguage_Enum2) => {
   return IssueLanguage_Enum2;
 })(IssueLanguage_Enum || {});
 var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
+  IssueType_Enum2["ActionNotPinnedToCommitSha"] = "ACTION_NOT_PINNED_TO_COMMIT_SHA";
   IssueType_Enum2["AutoEscapeFalse"] = "AUTO_ESCAPE_FALSE";
   IssueType_Enum2["AvoidBuiltinShadowing"] = "AVOID_BUILTIN_SHADOWING";
   IssueType_Enum2["AvoidIdentityComparisonCachedTypes"] = "AVOID_IDENTITY_COMPARISON_CACHED_TYPES";
@@ -1778,6 +1881,7 @@ var FixDetailsFragmentDoc = `
   gitBlameLogin
   severityValue
   vulnerabilityReportIssues {
+    category
     parsedIssueType
     parsedSeverity
     vulnerabilityReportIssueTags {
@@ -1786,6 +1890,9 @@ var FixDetailsFragmentDoc = `
   }
   sharedState {
     id
+    downloadedBy {
+      downloadSource
+    }
   }
   patchAndQuestions {
     __typename
@@ -1870,6 +1977,10 @@ var FixReportSummaryFieldsFragmentDoc = `
   vulnerabilityReport {
     scanDate
     vendor
+    projectId
+    project {
+      organizationId
+    }
     totalVulnerabilityReportIssuesCount: vulnerabilityReportIssues_aggregate {
       aggregate {
         count
@@ -2374,6 +2485,13 @@ var UpdateDownloadedFixDataDocument = `
   }
 }
     `;
+var GetUserMvsAutoFixDocument = `
+    query GetUserMvsAutoFix($userEmail: String!) {
+  user_email_notification_settings(where: {user: {email: {_eq: $userEmail}}}) {
+    mvs_auto_fix
+  }
+}
+    `;
 var defaultWrapper = (action, _operationName, _operationType, _variables) => action();
 function getSdk(client, withWrapper = defaultWrapper) {
   return {
@@ -2451,6 +2569,9 @@ function getSdk(client, withWrapper = defaultWrapper) {
     },
     updateDownloadedFixData(variables, requestHeaders, signal) {
       return withWrapper((wrappedRequestHeaders) => client.request({ document: UpdateDownloadedFixDataDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "updateDownloadedFixData", "mutation", variables);
+    },
+    GetUserMvsAutoFix(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: GetUserMvsAutoFixDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "GetUserMvsAutoFix", "query", variables);
     }
   };
 }
@@ -2753,7 +2874,8 @@ var fixDetailsData = {
   ["NO_ASSERT" /* NoAssert */]: void 0,
   ["FUNCTION_CALL_WITHOUT_PARENTHESES" /* FunctionCallWithoutParentheses */]: void 0,
   ["SPRING_DEFAULT_PERMIT" /* SpringDefaultPermit */]: void 0,
-  ["RETURN_IN_INIT" /* ReturnInInit */]: void 0
+  ["RETURN_IN_INIT" /* ReturnInInit */]: void 0,
+  ["ACTION_NOT_PINNED_TO_COMMIT_SHA" /* ActionNotPinnedToCommitSha */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/getIssueType.ts
@@ -2890,7 +3012,8 @@ var issueTypeMap = {
   ["NO_ASSERT" /* NoAssert */]: "No Assert",
   ["FUNCTION_CALL_WITHOUT_PARENTHESES" /* FunctionCallWithoutParentheses */]: "Function Call Without Parentheses",
   ["SPRING_DEFAULT_PERMIT" /* SpringDefaultPermit */]: "Spring Default Permit",
-  ["RETURN_IN_INIT" /* ReturnInInit */]: "Return in Init"
+  ["RETURN_IN_INIT" /* ReturnInInit */]: "Return in Init",
+  ["ACTION_NOT_PINNED_TO_COMMIT_SHA" /* ActionNotPinnedToCommitSha */]: "Action Not Pinned to Commit Sha"
 };
 var issueTypeZ = z.nativeEnum(IssueType_Enum);
 var getIssueTypeFriendlyString = (issueType) => {
@@ -6250,7 +6373,7 @@ async function getAdoSdk(params) {
       const url = new URL(repoUrl);
       const origin2 = url.origin.toLowerCase().endsWith(".visualstudio.com") ? DEFUALT_ADO_ORIGIN : url.origin.toLowerCase();
       const params2 = `path=/&versionDescriptor[versionOptions]=0&versionDescriptor[versionType]=commit&versionDescriptor[version]=${branch}&resolveLfs=true&$format=zip&api-version=5.0&download=true`;
-      const path13 = [
+      const path15 = [
         prefixPath,
         owner,
         projectName,
@@ -6261,7 +6384,7 @@ async function getAdoSdk(params) {
         "items",
         "items"
       ].filter(Boolean).join("/");
-      return new URL(`${path13}?${params2}`, origin2).toString();
+      return new URL(`${path15}?${params2}`, origin2).toString();
     },
     async getAdoBranchList({ repoUrl }) {
       try {
@@ -7716,14 +7839,14 @@ function getGithubSdk(params = {}) {
       };
     },
     async getGithubBlameRanges(params2) {
-      const { ref, gitHubUrl, path: path13 } = params2;
+      const { ref, gitHubUrl, path: path15 } = params2;
       const { owner, repo } = parseGithubOwnerAndRepo(gitHubUrl);
       const res = await octokit.graphql(
         GET_BLAME_DOCUMENT,
         {
           owner,
           repo,
-          path: path13,
+          path: path15,
           ref
         }
       );
@@ -8030,11 +8153,11 @@ var GithubSCMLib = class extends SCMLib {
       markdownComment: comment
     });
   }
-  async getRepoBlameRanges(ref, path13) {
+  async getRepoBlameRanges(ref, path15) {
     this._validateUrl();
     return await this.githubSdk.getGithubBlameRanges({
       ref,
-      path: path13,
+      path: path15,
       gitHubUrl: this.url
     });
   }
@@ -8448,13 +8571,13 @@ function parseGitlabOwnerAndRepo(gitlabUrl) {
   const { organization, repoName, projectPath } = parsingResult;
   return { owner: organization, repo: repoName, projectPath };
 }
-async function getGitlabBlameRanges({ ref, gitlabUrl, path: path13 }, options) {
+async function getGitlabBlameRanges({ ref, gitlabUrl, path: path15 }, options) {
   const { projectPath } = parseGitlabOwnerAndRepo(gitlabUrl);
   const api2 = getGitBeaker({
     url: gitlabUrl,
     gitlabAuthToken: options?.gitlabAuthToken
   });
-  const resp = await api2.RepositoryFiles.allFileBlames(projectPath, path13, ref);
+  const resp = await api2.RepositoryFiles.allFileBlames(projectPath, path15, ref);
   let lineNumber = 1;
   return resp.filter((range) => range.lines).map((range) => {
     const oldLineNumber = lineNumber;
@@ -8630,10 +8753,10 @@ var GitlabSCMLib = class extends SCMLib {
       markdownComment: comment
     });
   }
-  async getRepoBlameRanges(ref, path13) {
+  async getRepoBlameRanges(ref, path15) {
     this._validateUrl();
     return await getGitlabBlameRanges(
-      { ref, path: path13, gitlabUrl: this.url },
+      { ref, path: path15, gitlabUrl: this.url },
       {
         url: this.url,
         gitlabAuthToken: this.accessToken
@@ -9711,7 +9834,7 @@ async function postIssueComment(params) {
     fpDescription
   } = params;
   const {
-    path: path13,
+    path: path15,
     startLine,
     vulnerabilityReportIssue: {
       vulnerabilityReportIssueTags,
@@ -9726,7 +9849,7 @@ async function postIssueComment(params) {
 Refresh the page in order to see the changes.`,
     pull_number: pullRequest,
     commit_id: commitSha,
-    path: path13,
+    path: path15,
     line: startLine
   });
   const commentId = commentRes.data.id;
@@ -9760,7 +9883,7 @@ async function postFixComment(params) {
     scanner
   } = params;
   const {
-    path: path13,
+    path: path15,
     startLine,
     vulnerabilityReportIssue: { fixId, vulnerabilityReportIssueTags, category },
     vulnerabilityReportIssueId
@@ -9778,7 +9901,7 @@ async function postFixComment(params) {
 Refresh the page in order to see the changes.`,
     pull_number: pullRequest,
     commit_id: commitSha,
-    path: path13,
+    path: path15,
     line: startLine
   });
   const commentId = commentRes.data.id;
@@ -12166,6 +12289,132 @@ import { GraphQLClient as GraphQLClient2 } from "graphql-request";
 import { v4 as uuidv42 } from "uuid";
 init_configs();
 
+// src/mcp/types.ts
+import { z as z31 } from "zod";
+var ScanAndFixVulnerabilitiesToolSchema = z31.object({
+  path: z31.string()
+});
+var VulnerabilityReportIssueTagSchema = z31.object({
+  vulnerability_report_issue_tag_value: z31.nativeEnum(
+    Vulnerability_Report_Issue_Tag_Enum
+  )
+});
+var VulnerabilityReportIssueSchema = z31.object({
+  category: z31.any().optional().nullable(),
+  parsedIssueType: z31.nativeEnum(IssueType_Enum).nullable().optional(),
+  parsedSeverity: z31.nativeEnum(Vulnerability_Severity_Enum).nullable().optional(),
+  vulnerabilityReportIssueTags: z31.array(VulnerabilityReportIssueTagSchema)
+});
+var SharedStateSchema = z31.object({
+  __typename: z31.literal("fix_shared_state").optional(),
+  id: z31.any(),
+  // GraphQL uses `any` type for UUID
+  downloadedBy: z31.array(z31.any().nullable()).optional().nullable()
+});
+var UnstructuredFixExtraContextSchema = z31.object({
+  __typename: z31.literal("UnstructuredFixExtraContext").optional(),
+  key: z31.string(),
+  value: z31.any()
+  // GraphQL JSON type
+});
+var FixExtraContextResponseSchema = z31.object({
+  __typename: z31.literal("FixExtraContextResponse").optional(),
+  extraContext: z31.array(UnstructuredFixExtraContextSchema),
+  fixDescription: z31.string()
+});
+var FixDataSchema = z31.object({
+  __typename: z31.literal("FixData"),
+  patch: z31.string(),
+  patchOriginalEncodingBase64: z31.string(),
+  extraContext: FixExtraContextResponseSchema
+});
+var GetFixNoFixErrorSchema = z31.object({
+  __typename: z31.literal("GetFixNoFixError")
+});
+var PatchAndQuestionsSchema = z31.union([FixDataSchema, GetFixNoFixErrorSchema]);
+var McpFixSchema = z31.object({
+  __typename: z31.literal("fix").optional(),
+  id: z31.any(),
+  // GraphQL uses `any` type for UUID
+  confidence: z31.number(),
+  safeIssueType: z31.string().nullable(),
+  severityText: z31.string().nullable(),
+  gitBlameLogin: z31.string().nullable().optional(),
+  // Optional in GraphQL
+  severityValue: z31.number().nullable(),
+  vulnerabilityReportIssues: z31.array(VulnerabilityReportIssueSchema),
+  sharedState: SharedStateSchema.nullable().optional(),
+  // Optional in GraphQL
+  patchAndQuestions: PatchAndQuestionsSchema,
+  // Additional field added by the client
+  fixUrl: z31.string().optional()
+});
+var FixAggregateSchema = z31.object({
+  __typename: z31.literal("fix_aggregate").optional(),
+  aggregate: z31.object({
+    __typename: z31.literal("fix_aggregate_fields").optional(),
+    count: z31.number()
+  }).nullable()
+});
+var VulnerabilityReportIssueAggregateSchema = z31.object({
+  __typename: z31.literal("vulnerability_report_issue_aggregate").optional(),
+  aggregate: z31.object({
+    __typename: z31.literal("vulnerability_report_issue_aggregate_fields").optional(),
+    count: z31.number()
+  }).nullable()
+});
+var RepoSchema = z31.object({
+  __typename: z31.literal("repo").optional(),
+  originalUrl: z31.string()
+});
+var ProjectSchema = z31.object({
+  id: z31.any(),
+  // GraphQL uses `any` type for UUID
+  organizationId: z31.any()
+  // GraphQL uses `any` type for UUID
+});
+var VulnerabilityReportSchema = z31.object({
+  scanDate: z31.any().nullable(),
+  // GraphQL uses `any` type for timestamp
+  vendor: z31.string(),
+  // GraphQL generates as string, not enum
+  project: ProjectSchema,
+  totalVulnerabilityReportIssuesCount: VulnerabilityReportIssueAggregateSchema,
+  notFixableVulnerabilityReportIssuesCount: VulnerabilityReportIssueAggregateSchema
+});
+var FixReportSummarySchema = z31.object({
+  __typename: z31.literal("fixReport").optional(),
+  id: z31.any(),
+  // GraphQL uses `any` type for UUID
+  createdOn: z31.any(),
+  // GraphQL uses `any` type for timestamp
+  repo: RepoSchema.nullable(),
+  issueTypes: z31.any().nullable(),
+  // GraphQL uses `any` type for JSON
+  CRITICAL: FixAggregateSchema,
+  HIGH: FixAggregateSchema,
+  MEDIUM: FixAggregateSchema,
+  LOW: FixAggregateSchema,
+  fixes: z31.array(McpFixSchema),
+  userFixes: z31.array(McpFixSchema).optional(),
+  // Present in some responses but can be omitted
+  filteredFixesCount: FixAggregateSchema,
+  totalFixesCount: FixAggregateSchema,
+  vulnerabilityReport: VulnerabilityReportSchema
+});
+var ExpiredReportSchema = z31.object({
+  __typename: z31.literal("fixReport").optional(),
+  id: z31.any(),
+  // GraphQL uses `any` type for UUID
+  expirationOn: z31.any().nullable()
+  // GraphQL uses `any` type for timestamp
+});
+var GetLatestReportByRepoUrlResponseSchema = z31.object({
+  __typename: z31.literal("query_root").optional(),
+  fixReport: z31.array(FixReportSummarySchema),
+  expiredReport: z31.array(ExpiredReportSchema)
+});
+
 // src/mcp/services/ConfigStoreService.ts
 init_configs();
 import Configstore4 from "configstore";
@@ -12496,12 +12745,55 @@ var McpGQLClient = class {
         organizationId: organization.id,
         projectName
       });
-      const createdProject = await this.clientSdk.CreateProject({
-        organizationId: organization.id,
-        projectName
-      });
-      logDebug("[GraphQL] CreateProject successful", { result: createdProject });
-      return createdProject.createProject.projectId;
+      try {
+        const createdProject = await this.clientSdk.CreateProject({
+          organizationId: organization.id,
+          projectName
+        });
+        logDebug("[GraphQL] CreateProject successful", {
+          result: createdProject
+        });
+        return createdProject.createProject.projectId;
+      } catch (createError) {
+        const errorMessage = createError instanceof Error ? createError.message : String(createError);
+        const isConstraintViolation = errorMessage.includes(
+          "duplicate key value violates unique constraint"
+        ) && errorMessage.includes("project_name_organization_id_key");
+        if (isConstraintViolation) {
+          logDebug(
+            "[GraphQL] Project creation failed due to constraint violation, retrying fetch",
+            {
+              organizationId: organization.id,
+              projectName,
+              error: errorMessage
+            }
+          );
+          const retryOrgAndProjectRes = await this.clientSdk.getLastOrgAndNamedProject({
+            email: userEmail,
+            projectName
+          });
+          const retryProjectId = retryOrgAndProjectRes.user?.[0]?.userOrganizationsAndUserOrganizationRoles?.[0]?.organization?.projects?.[0]?.id;
+          if (retryProjectId) {
+            logDebug(
+              "[GraphQL] Successfully found existing project after constraint violation",
+              {
+                projectId: retryProjectId,
+                projectName
+              }
+            );
+            return retryProjectId;
+          }
+          logError(
+            "[GraphQL] Failed to find project even after constraint violation retry",
+            {
+              organizationId: organization.id,
+              projectName,
+              retryResult: retryOrgAndProjectRes
+            }
+          );
+        }
+        throw createError;
+      }
     } catch (e) {
       logError("[GraphQL] getProjectId failed", {
         error: e,
@@ -12559,18 +12851,56 @@ var McpGQLClient = class {
       return null;
     }
   }
-  mergeUserAndSystemFixes(reportData, limit) {
+  generateFixUrl({
+    fixId,
+    organizationId,
+    projectId,
+    reportId
+  }) {
+    if (!organizationId || !projectId || !reportId) {
+      return void 0;
+    }
+    const appBaseUrl = this.apiUrl.replace("/v1/graphql", "").replace("api.", "");
+    return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${reportId}/fix/${fixId}`;
+  }
+  mergeUserAndSystemFixes({
+    reportData,
+    limit
+  }) {
     if (!reportData) return [];
+    const reportMetadata = {
+      id: reportData.id,
+      organizationId: reportData.vulnerabilityReport?.project?.organizationId,
+      projectId: reportData.vulnerabilityReport?.project?.id
+    };
     const { userFixes = [], fixes = [] } = reportData;
     const fixMap = /* @__PURE__ */ new Map();
     for (const fix of userFixes) {
       if (fix.id) {
-        fixMap.set(fix.id, fix);
+        const fixWithUrl = {
+          ...fix,
+          fixUrl: this.generateFixUrl({
+            fixId: fix.id,
+            organizationId: reportMetadata?.organizationId,
+            projectId: reportMetadata?.projectId,
+            reportId: reportMetadata?.id
+          })
+        };
+        fixMap.set(fix.id, fixWithUrl);
       }
     }
     for (const fix of fixes) {
       if (fix.id && !fixMap.has(fix.id)) {
-        fixMap.set(fix.id, fix);
+        const fixWithUrl = {
+          ...fix,
+          fixUrl: this.generateFixUrl({
+            fixId: fix.id,
+            organizationId: reportMetadata?.organizationId,
+            projectId: reportMetadata?.projectId,
+            reportId: reportMetadata?.id
+          })
+        };
+        fixMap.set(fix.id, fixWithUrl);
       }
     }
     return Array.from(fixMap.values()).slice(0, limit);
@@ -12589,6 +12919,52 @@ var McpGQLClient = class {
       logDebug("[GraphQL] No fixes found to update download status");
     }
   }
+  async updateAutoAppliedFixesStatus(fixIds) {
+    if (fixIds.length > 0) {
+      const resUpdate = await this.clientSdk.updateDownloadedFixData({
+        fixIds,
+        source: "AUTO_MVS" /* AutoMvs */
+      });
+      logDebug("[GraphQL] updateAutoAppliedFixesStatus successful", {
+        result: resUpdate,
+        fixIds,
+        note: "Auto-applied via MVS automation"
+      });
+    } else {
+      logDebug("[GraphQL] No auto-applied fixes to update status");
+    }
+  }
+  async getMvsAutoFixSettings() {
+    try {
+      const envOverride = process.env["MVS_AUTO_FIX"];
+      if (envOverride !== void 0) {
+        const overrideValue = envOverride.toLowerCase() === "true";
+        logDebug("[Environment] Using MVS_AUTO_FIX override", {
+          envValue: envOverride,
+          resolvedValue: overrideValue
+        });
+        return overrideValue;
+      }
+      const userInfo = await this.getUserInfo();
+      if (!userInfo?.email) {
+        throw new Error("User email not found");
+      }
+      logDebug("[GraphQL] Calling GetUserMvsAutoFix query", {
+        userEmail: userInfo.email
+      });
+      const result = await this.clientSdk.GetUserMvsAutoFix({
+        userEmail: userInfo.email
+      });
+      logDebug("[GraphQL] GetUserMvsAutoFix successful", { result });
+      return result.user_email_notification_settings?.[0]?.mvs_auto_fix ?? true;
+    } catch (e) {
+      logError("[GraphQL] GetUserMvsAutoFix failed", {
+        error: e,
+        ...this.getErrorContext()
+      });
+      throw e;
+    }
+  }
   async getLatestReportByRepoUrl({
     repoUrl,
     limit = MCP_DEFAULT_LIMIT,
@@ -12611,23 +12987,27 @@ var McpGQLClient = class {
           error: err
         });
       }
-      const res = await this.clientSdk.GetLatestReportByRepoUrl({
+      const resp = await this.clientSdk.GetLatestReportByRepoUrl({
         repoUrl,
         limit,
         offset,
         currentUserEmail
       });
       logDebug("[GraphQL] GetLatestReportByRepoUrl successful", {
-        result: res,
-        reportCount: res.fixReport?.length || 0
+        result: resp,
+        reportCount: resp.fixReport?.length || 0
+      });
+      const latestReport = resp.fixReport?.[0] && FixReportSummarySchema.parse(resp.fixReport?.[0]);
+      const fixes = this.mergeUserAndSystemFixes({
+        reportData: latestReport,
+        limit
       });
-      const fixes = this.mergeUserAndSystemFixes(res.fixReport?.[0], limit);
       return {
-        fixReport: res.fixReport?.[0] ? {
-          ...res.fixReport?.[0],
+        fixReport: latestReport ? {
+          ...latestReport,
           fixes
         } : null,
-        expiredReport: res.expiredReport?.[0] || null
+        expiredReport: resp.expiredReport?.[0] || null
       };
     } catch (e) {
       logError("[GraphQL] GetLatestReportByRepoUrl failed", {
@@ -12687,11 +13067,20 @@ var McpGQLClient = class {
       if (res.fixReport.length === 0) {
         return null;
       }
-      const fixes = this.mergeUserAndSystemFixes(res.fixReport?.[0], limit);
+      const latestReport = FixReportSummarySchema.parse(res.fixReport?.[0]);
+      const fixes = this.mergeUserAndSystemFixes({
+        reportData: latestReport,
+        limit
+      });
       return {
         fixes,
         totalCount: res.fixReport?.[0]?.filteredFixesCount?.aggregate?.count || 0,
-        expiredReport: res.expiredReport?.[0] || null
+        expiredReport: res.expiredReport?.[0] || null,
+        fixReport: res.fixReport?.[0] ? {
+          id: res.fixReport[0].id,
+          organizationId: res.fixReport[0].vulnerabilityReport?.project?.organizationId,
+          projectId: res.fixReport[0].vulnerabilityReport?.projectId
+        } : void 0
       };
     } catch (e) {
       logError("[GraphQL] GetReportFixes failed", {
@@ -12778,6 +13167,7 @@ var McpServer = class {
     __publicField(this, "server");
     __publicField(this, "toolRegistry");
     __publicField(this, "isEventHandlersSetup", false);
+    __publicField(this, "eventHandlers", /* @__PURE__ */ new Map());
     this.server = new Server(
       {
         name: config4.name,
@@ -12795,7 +13185,10 @@ var McpServer = class {
     logInfo("MCP server instance created");
     logDebug("MCP server instance config", { config: config4 });
   }
-  handleProcessSignal(signal, error) {
+  handleProcessSignal({
+    signal,
+    error
+  }) {
     const messages = {
       SIGINT: "MCP server interrupted",
       SIGTERM: "MCP server terminated",
@@ -12850,9 +13243,11 @@ var McpServer = class {
       "warning"
     ];
     signals.forEach((signal) => {
-      process.on(signal, (error) => {
-        this.handleProcessSignal(signal, error);
-      });
+      const handler = (error) => {
+        this.handleProcessSignal({ signal, error });
+      };
+      this.eventHandlers.set(signal, handler);
+      process.on(signal, handler);
     });
     this.isEventHandlersSetup = true;
     logInfo("Process event handlers registered");
@@ -13005,11 +13400,17 @@ var McpServer = class {
   }
   async stop() {
     logDebug("MCP server shutting down");
+    this.eventHandlers.forEach((handler, signal) => {
+      process.removeListener(signal, handler);
+    });
+    this.eventHandlers.clear();
+    this.isEventHandlersSetup = false;
+    logDebug("Process event handlers cleaned up");
   }
 };
 
 // src/mcp/tools/checkForNewAvailableFixes/CheckForNewAvailableFixesTool.ts
-import { z as z32 } from "zod";
+import { z as z34 } from "zod";
 
 // src/mcp/services/PathValidation.ts
 import fs10 from "fs";
@@ -13078,7 +13479,7 @@ async function validatePath(inputPath) {
 }
 
 // src/mcp/tools/base/BaseTool.ts
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 var BaseTool = class {
   getDefinition() {
     return {
@@ -13106,7 +13507,7 @@ var BaseTool = class {
     try {
       return this.inputValidationSchema.parse(args);
     } catch (error) {
-      if (error instanceof z31.ZodError) {
+      if (error instanceof z32.ZodError) {
         const errorDetails = error.errors.map((e) => {
           const fieldPath = e.path.length > 0 ? e.path.join(".") : "root";
           const message = e.message === "Required" ? `Missing required parameter '${fieldPath}'` : `Invalid value for '${fieldPath}': ${e.message}`;
@@ -13478,7 +13879,71 @@ ${nextStepsPrompt({ scannedFiles })}
 `;
 };
 var noFreshFixesPrompt = `No fresh fixes available for this repository at this time. No user message needed. Do not show any comments to the user.`;
+var continuousMonitoringSection = `## \u{1F504} Continuous Monitoring Active
+
+The Mobb MCP is continuously monitoring your code and will **automatically apply fixes** when new vulnerabilities are detected in files you modify or create.`;
+var autoFixSettingsSection = `## \u2699\uFE0F Auto-Fix Settings
+
+If you prefer to review fixes manually before they're applied:
+- **Turn off automatic fixes** in your Mobb app settings at https://app.mobb.ai/ setting section
+- When disabled, you'll receive available fixes that you can apply manually through the \`${MCP_TOOL_CHECK_FOR_NEW_AVAILABLE_FIXES}\` MCP tool`;
+var whatHappensNextSection = `## \u{1F50D} What Happens Next
+
+- Continue coding normally - Mobb is watching in the background
+- Any new security issues will be automatically patched
+- You'll be notified when fixes are applied to your codebase
+- Review and commit changes when ready
+
+Your code is being actively protected! \u{1F680}`;
+var noVulnerabilitiesAutoFixPrompt = `\u{1F6E1}\uFE0F **MOBB AUTO-FIX MONITORING ACTIVE**
+
+## \u2705 No Fixable Vulnerabilities Detected
+
+No fixable vulnerabilities were detected so far.
+
+${continuousMonitoringSection}
+
+${autoFixSettingsSection}
+
+${whatHappensNextSection}`;
 var initialScanInProgressPrompt = `Initial scan is still in progress. No user message needed. Do not show any comments to the user.`;
+var authenticationRequiredPrompt = `# AUTHENTICATION REQUIRED: MOBB ACCESS NOT AUTHORIZED
+
+## MCP SERVICE UNAVAILABLE
+
+The Mobb MCP (Model Context Protocol) service is currently unavailable because authentication with Mobb has not been completed.
+
+## REQUIRED ACTION
+
+To use Mobb's automated security fix capabilities, you need to:
+
+1. **Authorize Mobb Access**
+   - Restart Mobb MCP
+   - A browser window will open for you to log in and authorize access
+
+2. **Complete Authentication**
+   - Sign in to your Mobb account (or create one if needed)
+   - Authorize the CLI tool to access Mobb services
+   - This creates a secure token for future automated scans
+
+## WHAT HAPPENS NEXT
+
+Once authentication is complete:
+- The MCP service will automatically start monitoring your repository
+- New security vulnerabilities will be detected and fixed automatically
+- You'll receive notifications about applied fixes through this interface
+
+## TROUBLESHOOTING
+
+If you're experiencing authentication issues:
+- Ensure you have an active internet connection
+- Check that you can access https://app.mobb.ai in your browser
+- Make sure your browser isn't blocking authentication pop-ups
+- Try running a manual scan with the \`--debug\` flag for detailed output
+
+For assistance:
+- Documentation: https://docs.mobb.ai
+- Support: support@mobb.ai`;
 var freshFixesPrompt = ({
   fixes,
   limit,
@@ -13499,6 +13964,67 @@ ${applyFixesPrompt({
   })}
 `;
 };
+function extractTargetFileFromPatch(patch) {
+  const match = patch?.match(/^diff --git a\/([^\s]+) b\//);
+  return match?.[1] || "Unknown file";
+}
+function formatSeverity(severityText, severityValue) {
+  if (severityText) return severityText;
+  if (severityValue !== null && severityValue !== void 0) {
+    if (severityValue >= 9) return "Critical";
+    if (severityValue >= 7) return "High";
+    if (severityValue >= 4) return "Medium";
+    return "Low";
+  }
+  return "Unknown";
+}
+var appliedFixesSummaryPrompt = ({
+  fixes,
+  gqlClient
+}) => {
+  const fixIds = fixes.map((fix) => fix.id);
+  void gqlClient.updateFixesDownloadStatus(fixIds);
+  const patchTime = (/* @__PURE__ */ new Date()).toLocaleString();
+  return `\u{1F6E1}\uFE0F **MOBB AUTO-FIX: VULNERABILITIES PATCHED**
+
+## \u2705 ${fixes.length} Security ${fixes.length === 1 ? "Fix" : "Fixes"} Automatically Applied
+
+Mobb has automatically detected and fixed ${fixes.length} security ${fixes.length === 1 ? "vulnerability" : "vulnerabilities"} in your codebase.
+
+## \u{1F4CB} Applied Fixes Summary
+
+${fixes.map((fix, index) => {
+    const vulnerabilityType = friendlyType(fix.safeIssueType || "Unknown");
+    const severity = formatSeverity(fix.severityText, fix.severityValue);
+    const description = fix.patchAndQuestions?.__typename === "FixData" ? fix.patchAndQuestions.extraContext?.fixDescription || "Security vulnerability fix" : "Security vulnerability fix";
+    const patch = fix.patchAndQuestions?.__typename === "FixData" ? fix.patchAndQuestions.patch : void 0;
+    const targetFile = extractTargetFileFromPatch(patch);
+    const gitBlameLogin = fix.gitBlameLogin || "Unknown";
+    return `### ${index + 1}. ${vulnerabilityType}
+
+**\u{1F3AF} Vulnerability Type:** ${vulnerabilityType}
+**\u{1F4CA} Severity:** ${severity}
+**\u{1F4DD} Description:** ${description}
+**\u{1F464} Git Blame:** ${gitBlameLogin}
+**\u{1F4C1} Target File:** \`${targetFile}\`
+**\u23F0 Patch Applied:** ${patchTime}
+
+---`;
+  }).join("\n")}
+
+${continuousMonitoringSection}
+
+${autoFixSettingsSection}
+
+## \u{1F4CB} Next Steps
+
+1. **Review the changes** - Check the modified files to understand what was fixed
+2. **Test your application** - Ensure the fixes don't break existing functionality  
+3. **Commit the changes** - Add and commit the security fixes to your repository
+4. **Continue coding** - Mobb will keep protecting your code automatically
+
+${whatHappensNextSection}`;
+};
 
 // src/mcp/services/GetLocalFiles.ts
 init_FileUtils();
@@ -13507,23 +14033,23 @@ init_configs();
 import fs11 from "fs/promises";
 import nodePath from "path";
 var getLocalFiles = async ({
-  path: path13,
+  path: path15,
   maxFileSize = MCP_MAX_FILE_SIZE,
   maxFiles,
   isAllFilesScan,
   scanContext
 }) => {
   logDebug(`[${scanContext}] Starting getLocalFiles`, {
-    path: path13,
+    path: path15,
     maxFileSize,
     maxFiles,
     isAllFilesScan
   });
   try {
-    const resolvedRepoPath = await fs11.realpath(path13);
+    const resolvedRepoPath = await fs11.realpath(path15);
     logDebug(`[${scanContext}] Resolved repository path`, {
       resolvedRepoPath,
-      originalPath: path13
+      originalPath: path15
     });
     const gitService = new GitService(resolvedRepoPath, log);
     const gitValidation = await gitService.validateRepository();
@@ -13536,7 +14062,7 @@ var getLocalFiles = async ({
     if (!gitValidation.isValid || isAllFilesScan) {
       try {
         files = await FileUtils.getLastChangedFiles({
-          dir: path13,
+          dir: path15,
           maxFileSize,
           maxFiles,
           isAllFilesScan
@@ -13628,53 +14154,1773 @@ var getLocalFiles = async ({
     logError(`${scanContext}Unexpected error in getLocalFiles`, {
       error: error instanceof Error ? error.message : String(error),
       stack: error instanceof Error ? error.stack : void 0,
-      path: path13
+      path: path15
     });
     throw error;
   }
 };
 
-// src/mcp/services/ScanFiles.ts
-init_GitService();
-init_configs();
-
-// src/mcp/services/FileOperations.ts
-init_FileUtils();
+// src/mcp/services/LocalMobbFolderService.ts
 import fs12 from "fs";
 import path12 from "path";
-import AdmZip2 from "adm-zip";
-var FileOperations = class {
+import { z as z33 } from "zod";
+init_GitService();
+function extractPathFromPatch(patch) {
+  const match = patch?.match(/diff --git a\/([^\s]+) b\//);
+  return match?.[1] ?? null;
+}
+function parsedIssueTypeRes(issueType) {
+  return z33.nativeEnum(IssueType_Enum).safeParse(issueType);
+}
+var LocalMobbFolderService = class {
   /**
-   * Creates a ZIP archive containing the specified source files
-   * @param fileList Array of relative file paths to include
-   * @param repositoryPath Base path for resolving relative file paths
-   * @param maxFileSize Maximum size allowed for individual files
-   * @returns ZIP archive as a Buffer with metadata
+   * Creates a new LocalMobbFolderService instance
+   * @param repoPath Path to the repository or directory (supports both git and non-git)
    */
-  async createSourceCodeArchive(fileList, repositoryPath, maxFileSize) {
-    logDebug("[FileOperations] Packing files");
-    const zip = new AdmZip2();
-    let packedFilesCount = 0;
-    const resolvedRepoPath = path12.resolve(repositoryPath);
-    for (const filepath of fileList) {
-      const absoluteFilepath = path12.join(repositoryPath, filepath);
-      const resolvedFilePath = path12.resolve(absoluteFilepath);
-      if (!resolvedFilePath.startsWith(resolvedRepoPath)) {
-        logDebug(
-          `[FileOperations] Skipping ${filepath} due to potential path traversal security risk`
+  constructor(repoPath) {
+    __publicField(this, "defaultMobbFolderName", ".mobb");
+    __publicField(this, "mobbIgnorePattern", "**/.mobb");
+    __publicField(this, "repoPath");
+    __publicField(this, "gitService");
+    this.repoPath = repoPath;
+    try {
+      this.gitService = new GitService(
+        repoPath,
+        (message, level, data) => {
+          if (level === "debug") {
+            logDebug(message, data);
+          } else if (level === "info") {
+            logInfo(message, data);
+          } else if (level === "error") {
+            logError(message, data);
+          }
+        }
+      );
+    } catch (error) {
+      logDebug("[LocalMobbFolderService] GitService initialization failed", {
+        repoPath,
+        error: String(error)
+      });
+      this.gitService = null;
+    }
+    logDebug("[LocalMobbFolderService] Service initialized", { repoPath });
+  }
+  /**
+   * Gets or creates the .mobb folder in the repository path
+   * For git repositories: ensures .gitignore exists and contains wildcard pattern to ignore .mobb folders
+   * For non-git directories: skips gitignore functionality but creates .mobb folder normally
+   * @returns Path to the .mobb folder
+   * @throws Error if path validation fails or folder creation fails
+   */
+  async getFolder() {
+    logDebug("[LocalMobbFolderService] Getting .mobb folder");
+    try {
+      const isGitRepo = this.gitService ? await this.gitService.isGitRepository() : false;
+      logDebug("[LocalMobbFolderService] Repository type detected", {
+        isGitRepo
+      });
+      if (isGitRepo && this.gitService) {
+        try {
+          const gitRoot = await this.gitService.getGitRoot();
+          logDebug("[LocalMobbFolderService] Git root found", { gitRoot });
+          const wasAdded = await this.gitService.ensureGitignoreEntry(
+            this.mobbIgnorePattern
+          );
+          if (wasAdded) {
+            logInfo(
+              "[LocalMobbFolderService] Added .mobb wildcard pattern to .gitignore",
+              {
+                pattern: this.mobbIgnorePattern
+              }
+            );
+          } else {
+            logDebug(
+              "[LocalMobbFolderService] .mobb pattern already in .gitignore"
+            );
+          }
+        } catch (gitError) {
+          logDebug(
+            "[LocalMobbFolderService] Git operations failed, treating as non-git repo",
+            { gitError }
+          );
+        }
+      } else {
+        logInfo(
+          "[LocalMobbFolderService] Non-git repository detected, skipping .gitignore operations"
         );
-        continue;
       }
-      if (!FileUtils.shouldPackFile(absoluteFilepath, maxFileSize)) {
-        logDebug(
-          `[FileOperations] Excluding ${filepath} - file is too large, binary, or matches exclusion rules`
-        );
-        continue;
+      const mobbFolderPath = path12.join(
+        this.repoPath,
+        this.defaultMobbFolderName
+      );
+      if (!fs12.existsSync(mobbFolderPath)) {
+        logInfo("[LocalMobbFolderService] Creating .mobb folder", {
+          mobbFolderPath
+        });
+        fs12.mkdirSync(mobbFolderPath, { recursive: true });
+      } else {
+        logDebug("[LocalMobbFolderService] .mobb folder already exists");
       }
-      const fileContent = await this.readSourceFile(absoluteFilepath, filepath);
-      if (fileContent) {
-        zip.addFile(filepath, fileContent);
-        packedFilesCount++;
+      const stats = fs12.statSync(mobbFolderPath);
+      if (!stats.isDirectory()) {
+        throw new Error(`Path exists but is not a directory: ${mobbFolderPath}`);
+      }
+      logDebug("[LocalMobbFolderService] .mobb folder ready", {
+        mobbFolderPath,
+        repoPath: this.repoPath,
+        isGitRepo
+      });
+      return mobbFolderPath;
+    } catch (error) {
+      const errorMessage = `Failed to get/create .mobb folder: ${error}`;
+      logError(errorMessage, { repoPath: this.repoPath, error });
+      throw new Error(errorMessage);
+    }
+  }
+  /**
+   * Public method to get or create the .mobb folder
+   * This is the main entry point for accessing the Mobb folder
+   * @returns Promise<string> Path to the .mobb folder
+   */
+  async getMobbFolder() {
+    return await this.getFolder();
+  }
+  /**
+   * Validates the repository (git or non-git) and ensures it's ready for Mobb operations
+   * For git repositories: validates git structure and accessibility
+   * For non-git directories: validates directory exists and is accessible
+   * @returns Promise<boolean> True if repository/directory is valid
+   * @throws Error if repository validation fails
+   */
+  async validateRepository() {
+    const isGitRepo = this.gitService ? await this.gitService.isGitRepository() : false;
+    if (isGitRepo && this.gitService) {
+      const result = await this.gitService.validateRepository();
+      if (!result.isValid) {
+        throw new Error(result.error || "Git repository validation failed");
+      }
+      logDebug("[LocalMobbFolderService] Git repository validated successfully");
+    } else {
+      try {
+        const stats = fs12.statSync(this.repoPath);
+        if (!stats.isDirectory()) {
+          throw new Error(
+            `Path exists but is not a directory: ${this.repoPath}`
+          );
+        }
+        fs12.accessSync(this.repoPath, fs12.constants.R_OK | fs12.constants.W_OK);
+        logDebug(
+          "[LocalMobbFolderService] Non-git directory validated successfully"
+        );
+      } catch (error) {
+        throw new Error(`Directory validation failed: ${error}`);
+      }
+    }
+    return true;
+  }
+  /**
+   * Extracts patch content from McpFix object
+   * @param fix McpFix object
+   * @returns Patch content or null if not available
+   */
+  extractPatchFromFix(fix) {
+    if (fix.patchAndQuestions.__typename === "FixData") {
+      return fix.patchAndQuestions.patch || null;
+    }
+    return null;
+  }
+  /**
+   * Extracts severity level from McpFix object
+   * @param fix McpFix object
+   * @returns Severity string
+   */
+  extractSeverity(fix) {
+    return fix.severityText?.toLowerCase() || "unknown";
+  }
+  /**
+   * Extracts vulnerability type from McpFix object
+   * @param fix McpFix object
+   * @returns Vulnerability type string
+   */
+  extractVulnerabilityType(fix) {
+    return fix.safeIssueType || "security-vulnerability";
+  }
+  /**
+   * Extracts filename from McpFix object by parsing the patch
+   * @param fix McpFix object
+   * @returns Filename or null if not determinable
+   */
+  extractFileNameFromFix(fix) {
+    const patch = this.extractPatchFromFix(fix);
+    if (!patch) {
+      return null;
+    }
+    const extractedPath = extractPathFromPatch(patch);
+    if (extractedPath) {
+      const pathParts = extractedPath.split("/");
+      const fileName = pathParts[pathParts.length - 1];
+      return fileName || null;
+    }
+    return `fix-${fix.id}`;
+  }
+  /**
+   * Saves a git patch as a file in the .mobb folder
+   * @param fix McpFix object containing all fix information
+   * @param customFileName Optional custom filename (overrides generated format)
+   * @returns Result of the save operation including file path
+   */
+  async savePatch(fix, customFileName) {
+    const patch = this.extractPatchFromFix(fix);
+    const severity = this.extractSeverity(fix);
+    const vulnerabilityType = this.extractVulnerabilityType(fix);
+    const fileName = this.extractFileNameFromFix(fix);
+    logDebug("[LocalMobbFolderService] Saving patch", {
+      fixId: fix.id,
+      fileName,
+      severity,
+      vulnerabilityType,
+      customFileName
+    });
+    try {
+      if (!patch || patch.trim().length === 0) {
+        const error = `No valid patch content found for fix ${fix.id}`;
+        logError("[LocalMobbFolderService] Invalid patch content", {
+          error,
+          fixId: fix.id
+        });
+        return {
+          success: false,
+          error,
+          message: "Failed to save patch: no valid patch content"
+        };
+      }
+      if (!fileName) {
+        const error = `Could not determine filename for fix ${fix.id}`;
+        logError("[LocalMobbFolderService] Missing fileName", {
+          error,
+          fixId: fix.id
+        });
+        return {
+          success: false,
+          error,
+          message: "Failed to save patch: could not determine filename"
+        };
+      }
+      const mobbFolderPath = await this.getFolder();
+      let baseFileName;
+      if (customFileName) {
+        baseFileName = customFileName.endsWith(".patch") ? customFileName : `${customFileName}.patch`;
+      } else {
+        baseFileName = this.generatePatchFileName(
+          severity,
+          vulnerabilityType,
+          fileName
+        );
+      }
+      const uniqueFileName = this.getUniqueFileName(
+        mobbFolderPath,
+        baseFileName
+      );
+      const filePath = path12.join(mobbFolderPath, uniqueFileName);
+      await fs12.promises.writeFile(filePath, patch, "utf8");
+      logInfo("[LocalMobbFolderService] Patch saved successfully", {
+        filePath,
+        fileName: uniqueFileName,
+        patchSize: patch.length
+      });
+      return {
+        success: true,
+        filePath,
+        fileName: uniqueFileName,
+        message: `Patch saved successfully as ${uniqueFileName}`
+      };
+    } catch (error) {
+      const errorMessage = `Failed to save patch for fix ${fix.id}: ${error}`;
+      logError(errorMessage, {
+        fixId: fix.id,
+        fileName,
+        severity,
+        vulnerabilityType,
+        customFileName,
+        error
+      });
+      return {
+        success: false,
+        error: errorMessage,
+        message: errorMessage
+      };
+    }
+  }
+  /**
+   * Generates a filename for a patch using the format: severity-vulnerabilityType-in-fileName.patch
+   * @param severity Severity level of the vulnerability
+   * @param vulnerabilityType Type of vulnerability
+   * @param fileName Name of the file being patched
+   * @returns Generated filename with .patch extension
+   */
+  generatePatchFileName(severity, vulnerabilityType, fileName) {
+    const safeSeverity = this.sanitizeForFilename(severity);
+    const safeVulnType = this.sanitizeForFilename(vulnerabilityType);
+    const safeFileName = this.sanitizeForFilename(fileName);
+    return `${safeSeverity}-${safeVulnType}-in-${safeFileName}.patch`;
+  }
+  /**
+   * Sanitizes a string to be safe for use in filenames
+   * @param input String to sanitize
+   * @returns Sanitized string safe for filenames
+   */
+  sanitizeForFilename(input) {
+    return input.toLowerCase().replace(/[^a-z0-9.-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  }
+  /**
+   * Gets a unique filename by adding index suffix if file already exists
+   * @param folderPath Path to the folder where file will be saved
+   * @param baseFileName Base filename to make unique
+   * @returns Unique filename that doesn't conflict with existing files
+   */
+  getUniqueFileName(folderPath, baseFileName) {
+    const baseName = path12.parse(baseFileName).name;
+    const extension = path12.parse(baseFileName).ext;
+    let uniqueFileName = baseFileName;
+    let index = 1;
+    while (fs12.existsSync(path12.join(folderPath, uniqueFileName))) {
+      uniqueFileName = `${baseName}-${index}${extension}`;
+      index++;
+      if (index > 1e3) {
+        const timestamp = Date.now();
+        uniqueFileName = `${baseName}-${timestamp}${extension}`;
+        break;
+      }
+    }
+    if (uniqueFileName !== baseFileName) {
+      logDebug(
+        "[LocalMobbFolderService] Generated unique filename to avoid conflict",
+        {
+          original: baseFileName,
+          unique: uniqueFileName
+        }
+      );
+    }
+    return uniqueFileName;
+  }
+  /**
+   * Logs fix details in markdown format to patchInfo.md file
+   * Prepends the new fix information to maintain chronological order (newest first)
+   * @param fix McpFix object containing fix details
+   * @param savedPatchFileName The filename of the saved patch file
+   * @returns Result of the log operation
+   */
+  async logPatch(fix, savedPatchFileName) {
+    logDebug("[LocalMobbFolderService] Logging patch info", { fixId: fix.id });
+    try {
+      const mobbFolderPath = await this.getFolder();
+      const patchInfoPath = path12.join(mobbFolderPath, "patchInfo.md");
+      const markdownContent = this.generateFixMarkdown(fix, savedPatchFileName);
+      let existingContent = "";
+      if (fs12.existsSync(patchInfoPath)) {
+        existingContent = await fs12.promises.readFile(patchInfoPath, "utf8");
+        logDebug("[LocalMobbFolderService] Existing patchInfo.md found");
+      } else {
+        logDebug("[LocalMobbFolderService] Creating new patchInfo.md file");
+      }
+      const separator = existingContent ? "\n\n================================================================================\n\n" : "";
+      const updatedContent = `${markdownContent}${separator}${existingContent}`;
+      await fs12.promises.writeFile(patchInfoPath, updatedContent, "utf8");
+      logInfo("[LocalMobbFolderService] Patch info logged successfully", {
+        patchInfoPath,
+        fixId: fix.id,
+        contentLength: updatedContent.length
+      });
+      return {
+        success: true,
+        filePath: patchInfoPath,
+        message: `Fix details logged to patchInfo.md`
+      };
+    } catch (error) {
+      const errorMessage = `Failed to log patch info: ${error}`;
+      logError(errorMessage, { fixId: fix.id, error });
+      return {
+        success: false,
+        error: errorMessage,
+        message: errorMessage
+      };
+    }
+  }
+  /**
+   * Generates markdown formatted content for a fix
+   * @param fix McpFix object to format
+   * @param savedPatchFileName The filename of the saved patch file
+   * @returns Markdown formatted string
+   */
+  generateFixMarkdown(fix, savedPatchFileName) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const patch = this.extractPatchFromFix(fix);
+    const relativePatchedFilePath = patch ? extractPathFromPatch(patch) : null;
+    const patchedFilePath = relativePatchedFilePath ? path12.resolve(this.repoPath, relativePatchedFilePath) : null;
+    const fixIdentifier = savedPatchFileName ? savedPatchFileName.replace(".patch", "") : fix.id;
+    let markdown = `# Fix ${fixIdentifier}
+
+`;
+    markdown += `**Logged:** ${timestamp}
+
+`;
+    if (patchedFilePath) {
+      markdown += `**Patched File:** ${patchedFilePath}
+
+`;
+    }
+    if (fix.fixUrl) {
+      markdown += `**Fix URL:** [View Fix](${fix.fixUrl})
+
+`;
+    }
+    if (fix.severityText) {
+      markdown += `**Severity:** ${fix.severityText}`;
+      if (fix.severityValue !== null && fix.severityValue !== void 0) {
+        markdown += ` (${fix.severityValue})`;
+      }
+      markdown += `
+
+`;
+    }
+    markdown += `**Confidence:** ${fix.confidence}
+
+`;
+    if (fix.safeIssueType) {
+      markdown += `**Issue Type:** ${fix.safeIssueType}
+
+`;
+    }
+    const parseIssueTypeRes = parsedIssueTypeRes(fix.safeIssueType || void 0);
+    const staticData = parseIssueTypeRes.success ? fixDetailsData[parseIssueTypeRes.data] : null;
+    const { issueDescription: issueDescription2, fixInstructions } = staticData || {};
+    markdown += `
+## Vulnerability Details
+
+`;
+    if (issueDescription2) {
+      markdown += `### Issue
+
+`;
+      markdown += `${issueDescription2}
+
+`;
+    }
+    if (fixInstructions) {
+      markdown += `### How to Fix
+
+`;
+      markdown += `${fixInstructions}
+
+`;
+    }
+    if (fix.vulnerabilityReportIssues.length > 0) {
+      fix.vulnerabilityReportIssues.forEach((issue) => {
+        if (issue.vulnerabilityReportIssueTags && issue.vulnerabilityReportIssueTags.length > 0) {
+          markdown += `**Tags:** ${issue.vulnerabilityReportIssueTags.map((tag) => tag.vulnerability_report_issue_tag_value).join(", ")}
+
+`;
+        }
+      });
+    }
+    if (fix.patchAndQuestions.__typename === "FixData") {
+      const fixData = fix.patchAndQuestions;
+      if (fixData.extraContext.fixDescription) {
+        markdown += `## Fix Description
+
+`;
+        markdown += `${fixData.extraContext.fixDescription}
+
+`;
+      }
+      if (fixData.extraContext.extraContext.length > 0) {
+        markdown += `## Additional Context
+
+`;
+        fixData.extraContext.extraContext.forEach((context) => {
+          markdown += `**${context.key}:** ${JSON.stringify(context.value)}
+
+`;
+        });
+      }
+      const patchLines = fixData.patch.split("\n");
+      const previewLines = patchLines.slice(0, 10);
+      markdown += `## Patch Preview
+
+`;
+      markdown += `\`\`\`diff
+`;
+      markdown += `${previewLines.join("\n")}`;
+      if (patchLines.length > 10) {
+        markdown += `
+... (${patchLines.length - 10} more lines)`;
+      }
+      markdown += `
+\`\`\`
+
+`;
+    } else if (fix.patchAndQuestions.__typename === "GetFixNoFixError") {
+      markdown += `## Fix Status
+
+`;
+      markdown += `\u26A0\uFE0F **No fix available** - This vulnerability could not be automatically fixed.
+
+`;
+    }
+    return markdown;
+  }
+  //   /**
+  //    * Gets information about a local Mobb folder
+  //    * @param folderPath Path to the folder to examine
+  //    * @returns Folder information including existence and basic stats
+  //    */
+  //   public async getFolderInfo(folderPath: string): Promise<FolderInfo> {
+  //     logDebug('[LocalMobbFolderService] Getting folder info', { folderPath })
+  //     const folderInfo: FolderInfo = {
+  //       path: folderPath,
+  //       exists: false,
+  //       isDirectory: false,
+  //     }
+  //     try {
+  //       const stats = await fs.promises.stat(folderPath)
+  //       folderInfo.exists = true
+  //       folderInfo.isDirectory = stats.isDirectory()
+  //       if (folderInfo.isDirectory) {
+  //         // Count files in directory
+  //         const files = await fs.promises.readdir(folderPath)
+  //         folderInfo.filesCount = files.length
+  //         // Calculate directory size (optional, can be expensive for large directories)
+  //         let totalSize = 0
+  //         for (const file of files) {
+  //           try {
+  //             const filePath = path.join(folderPath, file)
+  //             const fileStats = await fs.promises.stat(filePath)
+  //             if (fileStats.isFile()) {
+  //               totalSize += fileStats.size
+  //             }
+  //           } catch (error) {
+  //             logDebug('[LocalMobbFolderService] Error getting file size', { file, error })
+  //           }
+  //         }
+  //         folderInfo.size = totalSize
+  //       }
+  //     } catch (error) {
+  //       logDebug('[LocalMobbFolderService] Folder does not exist or is not accessible', {
+  //         folderPath,
+  //         error,
+  //       })
+  //     }
+  //     return folderInfo
+  //   }
+  //   /**
+  //    * Creates a local Mobb folder at the specified path
+  //    * @param basePath Base directory where the Mobb folder should be created
+  //    * @param folderName Optional custom folder name (defaults to '.mobb')
+  //    * @returns Result of the folder creation operation
+  //    */
+  //   public async createMobbFolder(
+  //     basePath: string,
+  //     folderName: string = this.defaultMobbFolderName
+  //   ): Promise<FolderCreationResult> {
+  //     const targetPath = path.join(basePath, folderName)
+  //     logInfo('[LocalMobbFolderService] Creating Mobb folder', { targetPath })
+  //     try {
+  //       // Check if base path exists
+  //       const basePathExists = await this.pathExists(basePath)
+  //       if (!basePathExists) {
+  //         const error = `Base path does not exist: ${basePath}`
+  //         logError(error)
+  //         return {
+  //           success: false,
+  //           path: targetPath,
+  //           error,
+  //         }
+  //       }
+  //       // Check if target folder already exists
+  //       const folderExists = await this.pathExists(targetPath)
+  //       if (folderExists) {
+  //         logInfo('[LocalMobbFolderService] Mobb folder already exists', { targetPath })
+  //         return {
+  //           success: true,
+  //           path: targetPath,
+  //         }
+  //       }
+  //       // Create the folder
+  //       await fs.promises.mkdir(targetPath, { recursive: true })
+  //       logInfo('[LocalMobbFolderService] Mobb folder created successfully', { targetPath })
+  //       return {
+  //         success: true,
+  //         path: targetPath,
+  //       }
+  //     } catch (error) {
+  //       const errorMessage = `Failed to create Mobb folder: ${error}`
+  //       logError(errorMessage, { targetPath, error })
+  //       return {
+  //         success: false,
+  //         path: targetPath,
+  //         error: errorMessage,
+  //       }
+  //     }
+  //   }
+  //   /**
+  //    * Finds the nearest Mobb folder by traversing up the directory tree
+  //    * @param startPath Starting directory to search from
+  //    * @param folderName Optional custom folder name to search for (defaults to '.mobb')
+  //    * @returns Path to the found Mobb folder or null if not found
+  //    */
+  //   public async findNearestMobbFolder(
+  //     startPath: string,
+  //     folderName: string = this.defaultMobbFolderName
+  //   ): Promise<string | null> {
+  //     logDebug('[LocalMobbFolderService] Searching for nearest Mobb folder', {
+  //       startPath,
+  //       folderName,
+  //     })
+  //     let currentPath = path.resolve(startPath)
+  //     const rootPath = path.parse(currentPath).root
+  //     while (currentPath !== rootPath) {
+  //       const mobbFolderPath = path.join(currentPath, folderName)
+  //       const folderInfo = await this.getFolderInfo(mobbFolderPath)
+  //       if (folderInfo.exists && folderInfo.isDirectory) {
+  //         logDebug('[LocalMobbFolderService] Found Mobb folder', { mobbFolderPath })
+  //         return mobbFolderPath
+  //       }
+  //       // Move up one directory
+  //       const parentPath = path.dirname(currentPath)
+  //       if (parentPath === currentPath) {
+  //         break // Reached the root
+  //       }
+  //       currentPath = parentPath
+  //     }
+  //     logDebug('[LocalMobbFolderService] No Mobb folder found')
+  //     return null
+  //   }
+  //   /**
+  //    * Cleans up a Mobb folder by removing its contents
+  //    * @param folderPath Path to the Mobb folder to clean
+  //    * @returns Result of the cleanup operation
+  //    */
+  //   public async cleanMobbFolder(folderPath: string): Promise<FolderOperationResult> {
+  //     logInfo('[LocalMobbFolderService] Cleaning Mobb folder', { folderPath })
+  //     try {
+  //       const folderInfo = await this.getFolderInfo(folderPath)
+  //       if (!folderInfo.exists) {
+  //         return {
+  //           success: false,
+  //           message: `Folder does not exist: ${folderPath}`,
+  //           error: 'Folder not found',
+  //         }
+  //       }
+  //       if (!folderInfo.isDirectory) {
+  //         return {
+  //           success: false,
+  //           message: `Path is not a directory: ${folderPath}`,
+  //           error: 'Not a directory',
+  //         }
+  //       }
+  //       // Remove all contents
+  //       const files = await fs.promises.readdir(folderPath)
+  //       for (const file of files) {
+  //         const filePath = path.join(folderPath, file)
+  //         try {
+  //           const stats = await fs.promises.stat(filePath)
+  //           if (stats.isDirectory()) {
+  //             await fs.promises.rmdir(filePath, { recursive: true })
+  //           } else {
+  //             await fs.promises.unlink(filePath)
+  //           }
+  //         } catch (error) {
+  //           logError('[LocalMobbFolderService] Error removing file/folder', {
+  //             filePath,
+  //             error,
+  //           })
+  //         }
+  //       }
+  //       logInfo('[LocalMobbFolderService] Mobb folder cleaned successfully', { folderPath })
+  //       return {
+  //         success: true,
+  //         message: `Successfully cleaned folder: ${folderPath}`,
+  //       }
+  //     } catch (error) {
+  //       const errorMessage = `Failed to clean Mobb folder: ${error}`
+  //       logError(errorMessage, { folderPath, error })
+  //       return {
+  //         success: false,
+  //         message: errorMessage,
+  //         error: String(error),
+  //       }
+  //     }
+  //   }
+  //   /**
+  //    * Validates that a path is safe for Mobb folder operations
+  //    * @param folderPath Path to validate
+  //    * @returns True if the path is safe to use
+  //    */
+  //   public validatePath(folderPath: string): boolean {
+  //     logDebug('[LocalMobbFolderService] Validating path', { folderPath })
+  //     // Check for path traversal attempts
+  //     if (folderPath.includes('..') || folderPath.includes('\0')) {
+  //       logError('[LocalMobbFolderService] Dangerous path detected', { folderPath })
+  //       return false
+  //     }
+  //     // Check for absolute path requirements (optional, depending on your needs)
+  //     const normalizedPath = path.normalize(folderPath)
+  //     if (normalizedPath.includes('..')) {
+  //       logError('[LocalMobbFolderService] Path traversal detected after normalization', {
+  //         folderPath,
+  //         normalizedPath,
+  //       })
+  //       return false
+  //     }
+  //     return true
+  //   }
+  //   /**
+  //    * Helper method to check if a path exists
+  //    * @param targetPath Path to check
+  //    * @returns True if the path exists
+  //    */
+  //   private async pathExists(targetPath: string): Promise<boolean> {
+  //     try {
+  //       await fs.promises.access(targetPath)
+  //       return true
+  //     } catch {
+  //       return false
+  //     }
+  //   }
+};
+
+// src/mcp/services/PatchApplicationService.ts
+init_configs();
+import {
+  existsSync as existsSync2,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import fs13 from "fs/promises";
+import parseDiff2 from "parse-diff";
+import path13 from "path";
+var PatchApplicationService = class {
+  /**
+   * Gets the appropriate comment syntax for a file based on its extension
+   */
+  static getCommentSyntax(filePath) {
+    const ext = path13.extname(filePath).toLowerCase();
+    const basename2 = path13.basename(filePath);
+    const commentMap = {
+      // C-style languages (single line comments)
+      ".js": "//",
+      ".jsx": "//",
+      ".mjs": "//",
+      ".cjs": "//",
+      ".ts": "//",
+      ".tsx": "//",
+      ".java": "//",
+      ".c": "//",
+      ".cpp": "//",
+      ".cc": "//",
+      ".cxx": "//",
+      ".c++": "//",
+      ".pcc": "//",
+      ".tpp": "//",
+      ".C": "//",
+      ".h": "//",
+      ".hpp": "//",
+      ".hh": "//",
+      ".hxx": "//",
+      ".inl": "//",
+      ".ipp": "//",
+      ".cs": "//",
+      ".php": "//",
+      ".tpl": "//",
+      ".phtml": "//",
+      ".go": "//",
+      ".rs": "//",
+      ".swift": "//",
+      ".kt": "//",
+      ".kts": "//",
+      ".ktm": "//",
+      ".scala": "//",
+      ".dart": "//",
+      ".cls": "//",
+      // Apex
+      ".sol": "//",
+      // Solidity
+      ".move": "//",
+      // Move
+      ".hack": "//",
+      // Hack
+      ".hck": "//",
+      // Hack
+      ".jl": "//",
+      // Julia
+      ".proto": "//",
+      // Protocol Buffers
+      // Python-style languages
+      ".py": "#",
+      ".pyx": "#",
+      ".pyi": "#",
+      ".sh": "#",
+      ".bash": "#",
+      ".zsh": "#",
+      ".fish": "#",
+      ".pl": "#",
+      ".pm": "#",
+      ".rb": "#",
+      ".r": "#",
+      ".R": "#",
+      ".yaml": "#",
+      ".yml": "#",
+      ".toml": "#",
+      ".conf": "#",
+      ".cfg": "#",
+      ".ini": "#",
+      ".dockerfile": "#",
+      ".Dockerfile": "#",
+      ".tf": "#",
+      // Terraform
+      ".tfvars": "#",
+      // Terraform
+      ".hcl": "#",
+      // Terraform/HCL
+      ".promql": "#",
+      // PromQL
+      ".cairo": "#",
+      // Cairo
+      ".circom": "#",
+      // Circom
+      // SQL
+      ".sql": "--",
+      // HTML/XML style
+      ".html": "<!--",
+      ".htm": "<!--",
+      ".xml": "<!--",
+      ".plist": "<!--",
+      ".xhtml": "<!--",
+      ".svg": "<!--",
+      ".vue": "<!--",
+      // Vue templates
+      // CSS
+      ".css": "/*",
+      ".less": "//",
+      ".scss": "//",
+      ".sass": "//",
+      // Other scripting
+      ".lua": "--",
+      ".vim": '"',
+      ".vimrc": '"',
+      ".ql": "//",
+      // QL
+      ".qll": "//",
+      // QL
+      // Assembly
+      ".asm": ";",
+      ".s": ";",
+      // Batch/PowerShell
+      ".bat": "REM",
+      ".cmd": "REM",
+      ".ps1": "#",
+      // Functional languages
+      ".hs": "--",
+      ".lhs": "--",
+      ".elm": "--",
+      ".ml": "(*",
+      ".mli": "(*",
+      ".fs": "//",
+      ".fsx": "//",
+      ".fsi": "//",
+      // Lisp family
+      ".lisp": ";",
+      ".lsp": ";",
+      ".cl": ";",
+      ".el": ";",
+      // Emacs Lisp
+      ".scm": ";",
+      ".ss": ";",
+      ".clj": ";",
+      ".cljs": ";",
+      ".cljc": ";",
+      ".edn": ";",
+      // Clojure EDN
+      // Configuration files
+      ".properties": "#",
+      ".gitignore": "#",
+      ".env": "#",
+      ".editorconfig": "#",
+      ".ex": "#",
+      // Elixir
+      ".exs": "#",
+      // Elixir
+      ".json": "//",
+      // JSON (though rarely commented)
+      ".ipynb": "#",
+      // Jupyter notebooks (JSON-based)
+      ".jsonnet": "//",
+      // Jsonnet
+      ".libsonnet": "//",
+      // Jsonnet
+      Dockerfile: "#",
+      // Docker files without extension
+      // Default fallback
+      "": "//"
+    };
+    if (commentMap[basename2]) {
+      return commentMap[basename2];
+    }
+    return commentMap[ext] || commentMap[""] || "//";
+  }
+  /**
+   * Writes content to a file and adds Mobb fix comment in debug mode
+   */
+  static writeFileWithFixComment({
+    filePath,
+    content,
+    fix,
+    scanContext
+  }) {
+    let finalContent = content;
+    if (MCP_AUTO_FIX_DEBUG_MODE) {
+      const fixType = fix.safeIssueType || "Security Issue";
+      let fixLink;
+      if (fix.fixUrl) {
+        fixLink = fix.fixUrl;
+      } else {
+        const apiUrl = process.env["API_URL"] || MCP_DEFAULT_API_URL;
+        const appBaseUrl = apiUrl.replace("/v1/graphql", "").replace("api.", "");
+        fixLink = `${appBaseUrl}/fixes/${fix.id}`;
+      }
+      const commentPrefix = this.getCommentSyntax(filePath);
+      const lines = content.split("\n");
+      const lastLine = lines[lines.length - 1]?.trim() || "";
+      const isMobbComment = lastLine.includes("Mobb security fix applied:");
+      const spacing = isMobbComment ? "\n" : "\n\n";
+      let comment;
+      if (commentPrefix === "<!--") {
+        comment = `${spacing}<!-- Mobb security fix applied: ${fixType} ${fixLink} -->`;
+      } else if (commentPrefix === "/*") {
+        comment = `${spacing}/* Mobb security fix applied: ${fixType} ${fixLink} */`;
+      } else if (commentPrefix === "(*") {
+        comment = `${spacing}(* Mobb security fix applied: ${fixType} ${fixLink} *)`;
+      } else {
+        comment = `${spacing}${commentPrefix} Mobb security fix applied: ${fixType} ${fixLink}`;
+      }
+      finalContent = content + comment;
+      logInfo(
+        `[${scanContext}] Debug mode: Adding fix comment to ${filePath}`,
+        {
+          fixId: fix.id,
+          fixType,
+          fixLink,
+          commentSyntax: commentPrefix,
+          spacing: isMobbComment ? "single line" : "empty line above"
+        }
+      );
+    }
+    const dirPath = path13.dirname(filePath);
+    mkdirSync(dirPath, { recursive: true });
+    writeFileSync(filePath, finalContent, "utf8");
+    return filePath;
+  }
+  /**
+   * Extracts target file path from a fix
+   */
+  static getFixTargetFile(fix) {
+    if (fix.patchAndQuestions?.__typename !== "FixData") {
+      return null;
+    }
+    const patch = fix.patchAndQuestions.patch;
+    if (!patch) return null;
+    const match = patch.match(/^\+\+\+ b\/(.+)$/m);
+    return match?.[1] || null;
+  }
+  /**
+   * Groups fixes by target file and returns ranked fixes with fallback options
+   */
+  static selectBestFixesPerFile(fixes) {
+    const fileToFixMap = /* @__PURE__ */ new Map();
+    const standaloneFixesFixes = [];
+    for (const fix of fixes) {
+      const targetFile = this.getFixTargetFile(fix);
+      if (!targetFile) {
+        standaloneFixesFixes.push(fix);
+        continue;
+      }
+      if (!fileToFixMap.has(targetFile)) {
+        fileToFixMap.set(targetFile, []);
+      }
+      const fixes2 = fileToFixMap.get(targetFile);
+      if (fixes2) {
+        fixes2.push(fix);
+      }
+    }
+    for (const [_targetFile, fileFixes] of fileToFixMap) {
+      fileFixes.sort((a, b) => (b.severityValue ?? 0) - (a.severityValue ?? 0));
+    }
+    return { fileFixGroups: fileToFixMap, standaloneFixesFixes };
+  }
+  /**
+   * Processes invalid fixes from file modification checks
+   */
+  static processInvalidFixes(invalidFixes, failedFixes, scanContext) {
+    if (invalidFixes.length === 0) return;
+    for (const invalidFix of invalidFixes) {
+      logWarn(
+        `[${scanContext}] Patch ${invalidFix.fix.id} not applied - file modified after scan`,
+        {
+          fixId: invalidFix.fix.id,
+          issueType: invalidFix.fix.safeIssueType,
+          severity: invalidFix.fix.severityText,
+          severityValue: invalidFix.fix.severityValue,
+          confidence: invalidFix.fix.confidence,
+          reason: invalidFix.reason
+        }
+      );
+    }
+    logInfo(
+      `[${scanContext}] Discarded ${invalidFixes.length} fixes due to file modifications after scan`,
+      {
+        discardedFixes: invalidFixes.map((f) => ({
+          fixId: f.fix.id,
+          reason: f.reason
+        }))
+      }
+    );
+    failedFixes.push(
+      ...invalidFixes.map((f) => ({ fix: f.fix, error: f.reason }))
+    );
+  }
+  /**
+   * Applies standalone fixes (fixes that don't target specific files)
+   */
+  static async applyStandaloneFixes({
+    fixes,
+    repositoryPath,
+    appliedFixes,
+    failedFixes,
+    scanContext
+  }) {
+    for (const fix of fixes) {
+      try {
+        const result = await this.applySingleFix({
+          fix,
+          repositoryPath,
+          scanContext
+        });
+        if (result.success) {
+          appliedFixes.push(fix);
+          logInfo(
+            `[${scanContext}] Successfully applied standalone fix ${fix.id}`,
+            {
+              issueType: fix.safeIssueType,
+              severity: fix.severityText
+            }
+          );
+        } else {
+          failedFixes.push({ fix, error: result.error || "Unknown error" });
+        }
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logError(`[${scanContext}] Failed to apply standalone fix ${fix.id}`, {
+          error: errorMessage,
+          issueType: fix.safeIssueType
+        });
+        failedFixes.push({ fix, error: errorMessage });
+      }
+    }
+  }
+  /**
+   * Attempts to apply a single fix and handles the result
+   */
+  static async attemptFixApplication({
+    fix,
+    targetFile,
+    attemptNumber,
+    totalAttempts,
+    repositoryPath,
+    scanContext
+  }) {
+    logInfo(
+      `[${scanContext}] Attempting fix ${fix.id} for ${targetFile} (priority ${attemptNumber}/${totalAttempts})`,
+      {
+        issueType: fix.safeIssueType,
+        severity: fix.severityText,
+        severityValue: fix.severityValue
+      }
+    );
+    try {
+      const result = await this.applySingleFix({
+        fix,
+        repositoryPath,
+        scanContext
+      });
+      if (result.success) {
+        logInfo(
+          `[${scanContext}] Successfully applied fix ${fix.id} to ${targetFile}`,
+          {
+            issueType: fix.safeIssueType,
+            severity: fix.severityText,
+            attemptNumber
+          }
+        );
+        return { success: true };
+      } else {
+        logInfo(
+          `[${scanContext}] Fix ${fix.id} failed for ${targetFile}, trying next option if available`,
+          {
+            error: result.error,
+            attemptNumber,
+            remainingOptions: totalAttempts - attemptNumber
+          }
+        );
+        return { success: false, error: result.error };
+      }
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      logInfo(
+        `[${scanContext}] Fix ${fix.id} threw exception for ${targetFile}, trying next option if available`,
+        {
+          error: errorMessage,
+          issueType: fix.safeIssueType,
+          attemptNumber,
+          remainingOptions: totalAttempts - attemptNumber
+        }
+      );
+      return { success: false, error: errorMessage };
+    }
+  }
+  /**
+   * Applies fixes for a specific file with fallback logic
+   */
+  static async applyFixesForFile({
+    targetFile,
+    rankedFixes,
+    repositoryPath,
+    appliedFixes,
+    failedFixes,
+    skippedFixes,
+    scanContext
+  }) {
+    let appliedForFile = false;
+    for (let i = 0; i < rankedFixes.length; i++) {
+      const fix = rankedFixes[i];
+      if (!fix) continue;
+      if (appliedForFile) {
+        const reason = `Another fix was already successfully applied to ${targetFile}`;
+        skippedFixes.push({
+          fix,
+          reason
+        });
+        logWarn(
+          `[${scanContext}] Patch ${fix.id} not applied - file already patched`,
+          {
+            fixId: fix.id,
+            targetFile,
+            issueType: fix.safeIssueType,
+            severity: fix.severityText,
+            severityValue: fix.severityValue,
+            reason,
+            confidence: fix.confidence
+          }
+        );
+        continue;
+      }
+      const result = await this.attemptFixApplication({
+        fix,
+        targetFile,
+        attemptNumber: i + 1,
+        totalAttempts: rankedFixes.length,
+        repositoryPath,
+        scanContext
+      });
+      if (result.success) {
+        appliedFixes.push(fix);
+        appliedForFile = true;
+      } else {
+        if (i === rankedFixes.length - 1) {
+          failedFixes.push({ fix, error: result.error || "Unknown error" });
+        }
+      }
+    }
+  }
+  /**
+   * Applies fixes grouped by file with fallback logic
+   */
+  static async applyFileGroupFixes({
+    fileFixGroups,
+    repositoryPath,
+    appliedFixes,
+    failedFixes,
+    skippedFixes,
+    scanContext
+  }) {
+    for (const [targetFile, rankedFixes] of fileFixGroups) {
+      await this.applyFixesForFile({
+        targetFile,
+        rankedFixes,
+        repositoryPath,
+        appliedFixes,
+        failedFixes,
+        skippedFixes,
+        scanContext
+      });
+    }
+  }
+  /**
+   * Logs skipped fixes as informational warnings
+   */
+  static logSkippedFixes(skippedFixes, scanContext) {
+    if (skippedFixes.length === 0) return;
+    logWarn(
+      `[${scanContext}] ${skippedFixes.length} fixes skipped because other fixes were successfully applied to their target files`,
+      {
+        skippedFixes: skippedFixes.map((f) => ({
+          fixId: f.fix.id,
+          reason: f.reason,
+          severity: f.fix.severityText,
+          issueType: f.fix.safeIssueType
+        }))
+      }
+    );
+  }
+  /**
+   * Checks if target files have been modified since scan time
+   */
+  static async checkFileModificationTimes({
+    fixes,
+    repositoryPath,
+    scanStartTime,
+    scanContext
+  }) {
+    const validFixes = [];
+    const invalidFixes = [];
+    for (const fix of fixes) {
+      const targetFile = this.getFixTargetFile(fix);
+      if (!targetFile) {
+        validFixes.push(fix);
+        continue;
+      }
+      try {
+        const absolutePath = path13.resolve(repositoryPath, targetFile);
+        if (existsSync2(absolutePath)) {
+          const stats = await fs13.stat(absolutePath);
+          const fileModTime = stats.mtime.getTime();
+          if (fileModTime > scanStartTime) {
+            logError(
+              `[${scanContext}] Target file ${targetFile} was modified after scan started (file: ${new Date(fileModTime).toISOString()}, scan: ${new Date(scanStartTime).toISOString()})`
+            );
+            invalidFixes.push({
+              fix,
+              reason: `Target file ${targetFile} was modified after scan started (file: ${new Date(fileModTime).toISOString()}, scan: ${new Date(scanStartTime).toISOString()})`
+            });
+          } else {
+            validFixes.push(fix);
+          }
+        } else {
+          validFixes.push(fix);
+        }
+      } catch (error) {
+        logError(
+          `[${scanContext}] Error checking modification time for ${targetFile}`,
+          {
+            error: error instanceof Error ? error.message : String(error)
+          }
+        );
+        validFixes.push(fix);
+      }
+    }
+    return { validFixes, invalidFixes };
+  }
+  /**
+   * Applies multiple patches to the repository
+   */
+  static async applyFixes({
+    fixes,
+    repositoryPath,
+    scanStartTime,
+    gqlClient,
+    scanContext
+  }) {
+    const appliedFixes = [];
+    const failedFixes = [];
+    const skippedFixes = [];
+    const resolvedRepoPath = await fs13.realpath(repositoryPath);
+    logInfo(
+      `[${scanContext}] Starting patch application for ${fixes.length} fixes`,
+      {
+        repositoryPath,
+        resolvedRepoPath,
+        fixIds: fixes.map((f) => f.id),
+        scanStartTime: scanStartTime ? new Date(scanStartTime).toISOString() : "not provided"
+      }
+    );
+    let processedFixes = fixes;
+    if (scanStartTime) {
+      const { validFixes, invalidFixes } = await this.checkFileModificationTimes({
+        fixes,
+        repositoryPath: resolvedRepoPath,
+        scanStartTime,
+        scanContext
+      });
+      this.processInvalidFixes(invalidFixes, failedFixes, scanContext);
+      processedFixes = validFixes;
+    }
+    const { fileFixGroups, standaloneFixesFixes } = this.selectBestFixesPerFile(processedFixes);
+    logInfo(
+      `[${scanContext}] Grouped fixes: ${standaloneFixesFixes.length} standalone fixes, ${fileFixGroups.size} file groups`,
+      {
+        originalCount: fixes.length,
+        totalFixesToApply: standaloneFixesFixes.length + fileFixGroups.size
+      }
+    );
+    await this.applyStandaloneFixes({
+      fixes: standaloneFixesFixes,
+      repositoryPath: resolvedRepoPath,
+      appliedFixes,
+      failedFixes,
+      scanContext
+    });
+    await this.applyFileGroupFixes({
+      fileFixGroups,
+      repositoryPath: resolvedRepoPath,
+      appliedFixes,
+      failedFixes,
+      skippedFixes,
+      scanContext
+    });
+    this.logSkippedFixes(skippedFixes, scanContext);
+    logInfo(`[${scanContext}] Patch application completed`, {
+      total: fixes.length,
+      applied: appliedFixes.length,
+      failed: failedFixes.length,
+      skipped: skippedFixes.length
+    });
+    if (appliedFixes.length > 0 && gqlClient) {
+      try {
+        const appliedFixIds = appliedFixes.map((fix) => fix.id).filter(Boolean);
+        await gqlClient.updateAutoAppliedFixesStatus(appliedFixIds);
+        logDebug(
+          `[${scanContext}] Successfully updated download status for auto-applied fixes`,
+          {
+            appliedFixIds,
+            count: appliedFixIds.length
+          }
+        );
+      } catch (error) {
+        logError(
+          `[${scanContext}] Failed to update download status for auto-applied fixes`,
+          {
+            error: error instanceof Error ? error.message : String(error),
+            appliedFixCount: appliedFixes.length
+          }
+        );
+      }
+    }
+    return {
+      success: appliedFixes.length > 0,
+      appliedFixes,
+      failedFixes
+    };
+  }
+  /**
+   * Validates fix data and returns patch content
+   */
+  static validateFixData(fix, scanContext) {
+    if (fix.patchAndQuestions?.__typename !== "FixData") {
+      const error = "Fix does not contain patch data";
+      logError(`[${scanContext}] Fix ${fix.id} does not contain patch data`);
+      return { success: false, error };
+    }
+    const patch = fix.patchAndQuestions.patch;
+    if (!patch) {
+      const error = "Fix has empty patch content";
+      logError(`[${scanContext}] Fix ${fix.id} has empty patch content`);
+      return { success: false, error };
+    }
+    return { success: true, patch };
+  }
+  /**
+   * Logs patch application information with error handling
+   */
+  static logPatchInfo(fix, patch, targetFiles, scanContext) {
+    try {
+      logInfo(`[${scanContext}] Applying patch for fix ${fix.id}`, {
+        fixType: fix.safeIssueType,
+        severity: fix.severityText,
+        confidence: fix.confidence,
+        targetFiles,
+        patchLength: patch.length,
+        patchPreview: patch.substring(0, 200) + (patch.length > 200 ? "..." : ""),
+        description: fix.patchAndQuestions.__typename === "FixData" ? fix.patchAndQuestions.extraContext?.fixDescription : void 0
+      });
+    } catch (logError2) {
+      logInfo(
+        `[${scanContext}] Applying patch for fix ${fix.id} - fixType: ${fix.safeIssueType}`
+      );
+    }
+  }
+  /**
+   * Parses a patch and validates it contains changes
+   */
+  static parsePatchSafely({
+    patch,
+    fixId,
+    scanContext
+  }) {
+    const parsedPatch = parseDiff2(patch);
+    if (!parsedPatch || parsedPatch.length === 0) {
+      throw new Error("Failed to parse patch - no changes found");
+    }
+    logDebug(`[${scanContext}] Parsed patch for fix ${fixId}`, {
+      filesCount: parsedPatch.length,
+      files: parsedPatch.map((f) => ({
+        from: f.from,
+        to: f.to,
+        deletions: f.deletions,
+        additions: f.additions
+      }))
+    });
+    return parsedPatch;
+  }
+  /**
+   * Resolves file paths for patch application
+   */
+  static resolveFilePaths({
+    targetFile,
+    repositoryPath,
+    scanContext
+  }) {
+    const sanitizedRepoPath = String(repositoryPath || "").replace("\0", "").replace(/^(\.\.(\/|\\))+/, "");
+    const sanitizedTargetFile = String(targetFile || "").replace("\0", "").replace(/^(\.\.(\/|\\))+/, "");
+    const absoluteFilePath = path13.resolve(
+      sanitizedRepoPath,
+      sanitizedTargetFile
+    );
+    const relativePath = path13.relative(sanitizedRepoPath, absoluteFilePath);
+    if (relativePath.startsWith("..")) {
+      throw new Error(
+        `Security violation: target file ${targetFile} resolves outside repository`
+      );
+    }
+    logDebug(`[${scanContext}] Resolving file path for ${targetFile}`, {
+      repositoryPath: sanitizedRepoPath,
+      targetFile: sanitizedTargetFile,
+      absoluteFilePath,
+      relativePath,
+      exists: existsSync2(absoluteFilePath)
+    });
+    return { absoluteFilePath, relativePath };
+  }
+  /**
+   * Handles file creation from patch
+   */
+  static handleFileCreation({
+    fileDiff,
+    absoluteFilePath,
+    relativePath,
+    repositoryPath,
+    fix,
+    appliedFiles,
+    scanContext
+  }) {
+    const newContent = this.applyHunksToEmptyFile(fileDiff.chunks);
+    const actualPath = this.writeFileWithFixComment({
+      filePath: absoluteFilePath,
+      content: newContent,
+      fix,
+      scanContext
+    });
+    appliedFiles.push(path13.relative(repositoryPath, actualPath));
+    logDebug(`[${scanContext}] Created new file: ${relativePath}`);
+  }
+  /**
+   * Handles file deletion from patch
+   */
+  static handleFileDeletion({
+    absoluteFilePath,
+    relativePath,
+    appliedFiles,
+    scanContext
+  }) {
+    if (existsSync2(absoluteFilePath)) {
+      unlinkSync(absoluteFilePath);
+      appliedFiles.push(relativePath);
+      logDebug(`[${scanContext}] Deleted file: ${relativePath}`);
+    }
+  }
+  /**
+   * Handles file modification from patch
+   */
+  static handleFileModification({
+    fileDiff,
+    absoluteFilePath,
+    relativePath,
+    targetFile,
+    repositoryPath,
+    fix,
+    appliedFiles,
+    scanContext
+  }) {
+    if (!existsSync2(absoluteFilePath)) {
+      throw new Error(
+        `Target file does not exist: ${targetFile} (resolved to: ${absoluteFilePath})`
+      );
+    }
+    const originalContent = readFileSync(absoluteFilePath, "utf8");
+    const modifiedContent = this.applyHunksToFile(
+      originalContent,
+      fileDiff.chunks
+    );
+    if (modifiedContent !== originalContent) {
+      const actualPath = this.writeFileWithFixComment({
+        filePath: absoluteFilePath,
+        content: modifiedContent,
+        fix,
+        scanContext
+      });
+      appliedFiles.push(path13.relative(repositoryPath, actualPath));
+      logDebug(`[${scanContext}] Modified file: ${relativePath}`);
+    }
+  }
+  /**
+   * Processes a single file diff from a parsed patch
+   */
+  static processFileDiff({
+    fileDiff,
+    repositoryPath,
+    fix,
+    appliedFiles,
+    scanContext
+  }) {
+    const targetFile = fileDiff.to || fileDiff.from;
+    if (!targetFile || targetFile === "/dev/null") {
+      return;
+    }
+    const { absoluteFilePath, relativePath } = this.resolveFilePaths({
+      targetFile,
+      repositoryPath,
+      scanContext
+    });
+    if (fileDiff.from === "/dev/null") {
+      this.handleFileCreation({
+        fileDiff,
+        absoluteFilePath,
+        relativePath,
+        repositoryPath,
+        fix,
+        appliedFiles,
+        scanContext
+      });
+    } else if (fileDiff.to === "/dev/null") {
+      this.handleFileDeletion({
+        absoluteFilePath,
+        relativePath,
+        appliedFiles,
+        scanContext
+      });
+    } else {
+      this.handleFileModification({
+        fileDiff,
+        absoluteFilePath,
+        relativePath,
+        targetFile,
+        repositoryPath,
+        fix,
+        appliedFiles,
+        scanContext
+      });
+    }
+  }
+  /**
+   * Applies a single patch using git apply
+   */
+  static async applySingleFix({
+    fix,
+    repositoryPath,
+    scanContext
+  }) {
+    const validation = this.validateFixData(fix, scanContext);
+    if (!validation.success) {
+      return { success: false, error: validation.error };
+    }
+    const patch = validation.patch;
+    let targetFiles = [];
+    try {
+      targetFiles = this.extractTargetFilesFromPatch(patch);
+    } catch (extractError) {
+      logError(
+        `[${scanContext}] Failed to extract target files from patch for fix ${fix.id}`,
+        {
+          error: extractError instanceof Error ? extractError.message : String(extractError)
+        }
+      );
+    }
+    this.logPatchInfo(fix, patch, targetFiles, scanContext);
+    try {
+      logDebug(`[${scanContext}] Applying patch in memory for fix ${fix.id}`, {
+        repositoryPath,
+        targetFiles
+      });
+      const parsedPatch = this.parsePatchSafely({
+        patch,
+        fixId: fix.id,
+        scanContext
+      });
+      const appliedFiles = [];
+      for (const fileDiff of parsedPatch) {
+        this.processFileDiff({
+          fileDiff,
+          repositoryPath,
+          fix,
+          appliedFiles,
+          scanContext
+        });
+      }
+      logInfo(
+        `[${scanContext}] In-memory patch application successful for fix ${fix.id}`,
+        {
+          appliedFiles,
+          filesCount: appliedFiles.length
+        }
+      );
+      return { success: true };
+    } catch (patchError) {
+      const errorMessage = patchError instanceof Error ? patchError.message : String(patchError);
+      logError(
+        `[${scanContext}] In-memory patch application failed for fix ${fix.id}`,
+        {
+          errorMessage,
+          patchErrorType: patchError instanceof Error ? patchError.name : typeof patchError,
+          targetFiles
+        }
+      );
+      return {
+        success: false,
+        error: `Patch application failed: ${errorMessage}`
+      };
+    }
+  }
+  /**
+   * Extracts the file path from a git patch
+   */
+  static extractPathFromPatch(patch) {
+    if (!patch) return null;
+    const match = patch.match(/^diff --git a\/([^\s]+) b\//);
+    return match?.[1] ?? null;
+  }
+  /**
+   * Extracts target file paths from a git patch
+   */
+  static extractTargetFilesFromPatch(patch) {
+    const targetFiles = [];
+    const lines = patch.split("\n");
+    for (const line of lines) {
+      if (line.startsWith("+++ b/")) {
+        const filePath = line.substring(6);
+        if (filePath && !targetFiles.includes(filePath)) {
+          targetFiles.push(filePath);
+        }
+      } else if (line.startsWith("diff --git a/") && line.includes(" b/")) {
+        const match = line.match(/diff --git a\/.+ b\/(.+)/);
+        if (match?.[1] && !targetFiles.includes(match[1])) {
+          targetFiles.push(match[1]);
+        }
+      }
+    }
+    return targetFiles;
+  }
+  /**
+   * Apply hunks to an empty file (for file creation)
+   */
+  static applyHunksToEmptyFile(chunks) {
+    const lines = [];
+    for (const chunk of chunks) {
+      for (const change of chunk.changes) {
+        if (change.type === "add") {
+          lines.push(change.content.substring(1));
+        }
+      }
+    }
+    return lines.join("\n");
+  }
+  /**
+   * Apply hunks to an existing file content
+   */
+  static applyHunksToFile(originalContent, chunks) {
+    const originalLines = originalContent.split("\n");
+    const result = [...originalLines];
+    const sortedChunks = chunks.sort((a, b) => b.oldStart - a.oldStart);
+    for (const chunk of sortedChunks) {
+      const { oldStart, oldLines } = chunk;
+      const startIndex = oldStart - 1;
+      const newLines = [];
+      for (const change of chunk.changes) {
+        if (change.type === "add") {
+          newLines.push(change.content.substring(1));
+        } else if (change.type === "normal") {
+          newLines.push(change.content.substring(1));
+        }
+      }
+      result.splice(startIndex, oldLines, ...newLines);
+    }
+    return result.join("\n");
+  }
+};
+
+// src/mcp/services/ScanFiles.ts
+init_GitService();
+init_configs();
+
+// src/mcp/services/FileOperations.ts
+init_FileUtils();
+import fs14 from "fs";
+import path14 from "path";
+import AdmZip2 from "adm-zip";
+var FileOperations = class {
+  /**
+   * Creates a ZIP archive containing the specified source files
+   * @param fileList Array of relative file paths to include
+   * @param repositoryPath Base path for resolving relative file paths
+   * @param maxFileSize Maximum size allowed for individual files
+   * @returns ZIP archive as a Buffer with metadata
+   */
+  async createSourceCodeArchive({
+    fileList,
+    repositoryPath,
+    maxFileSize
+  }) {
+    logDebug("[FileOperations] Packing files");
+    const zip = new AdmZip2();
+    let packedFilesCount = 0;
+    const packedFiles = [];
+    const excludedFiles = [];
+    const resolvedRepoPath = path14.resolve(repositoryPath);
+    for (const filepath of fileList) {
+      const absoluteFilepath = path14.join(repositoryPath, filepath);
+      const resolvedFilePath = path14.resolve(absoluteFilepath);
+      if (!resolvedFilePath.startsWith(resolvedRepoPath)) {
+        const reason = "potential path traversal security risk";
+        logDebug(`[FileOperations] Skipping ${filepath} due to ${reason}`);
+        excludedFiles.push({ file: filepath, reason });
+        continue;
+      }
+      if (!FileUtils.shouldPackFile(absoluteFilepath, maxFileSize)) {
+        const reason = "file is too large, binary, or matches exclusion rules";
+        logDebug(`[FileOperations] Excluding ${filepath} - ${reason}`);
+        excludedFiles.push({ file: filepath, reason });
+        continue;
+      }
+      const fileContent = await this.readSourceFile({
+        absoluteFilepath,
+        relativeFilepath: filepath
+      });
+      if (fileContent) {
+        zip.addFile(filepath, fileContent);
+        packedFilesCount++;
+        packedFiles.push(filepath);
+      } else {
+        const reason = "failed to read file content";
+        excludedFiles.push({ file: filepath, reason });
       }
     }
     const archiveBuffer = zip.toBuffer();
@@ -13694,12 +15940,15 @@ var FileOperations = class {
    * @param repositoryPath Base path for validation
    * @returns Array of validated file paths
    */
-  async validateFilePaths(fileList, repositoryPath) {
-    const resolvedRepoPath = path12.resolve(repositoryPath);
+  async validateFilePaths({
+    fileList,
+    repositoryPath
+  }) {
+    const resolvedRepoPath = path14.resolve(repositoryPath);
     const validatedPaths = [];
     for (const filepath of fileList) {
-      const absoluteFilepath = path12.join(repositoryPath, filepath);
-      const resolvedFilePath = path12.resolve(absoluteFilepath);
+      const absoluteFilepath = path14.join(repositoryPath, filepath);
+      const resolvedFilePath = path14.resolve(absoluteFilepath);
       if (!resolvedFilePath.startsWith(resolvedRepoPath)) {
         logDebug(
           `[FileOperations] Rejecting ${filepath} - path traversal attempt detected`
@@ -13707,7 +15956,7 @@ var FileOperations = class {
         continue;
       }
       try {
-        await fs12.promises.access(absoluteFilepath, fs12.constants.R_OK);
+        await fs14.promises.access(absoluteFilepath, fs14.constants.R_OK);
         validatedPaths.push(filepath);
       } catch (error) {
         logDebug(
@@ -13726,8 +15975,8 @@ var FileOperations = class {
     const fileDataArray = [];
     for (const absolutePath of filePaths) {
       try {
-        const content = await fs12.promises.readFile(absolutePath);
-        const relativePath = path12.basename(absolutePath);
+        const content = await fs14.promises.readFile(absolutePath);
+        const relativePath = path14.basename(absolutePath);
         fileDataArray.push({
           relativePath,
           absolutePath,
@@ -13747,9 +15996,12 @@ var FileOperations = class {
    * @param relativeFilepath Relative path for logging purposes
    * @returns File content as Buffer or null if failed
    */
-  async readSourceFile(absoluteFilepath, relativeFilepath) {
+  async readSourceFile({
+    absoluteFilepath,
+    relativeFilepath
+  }) {
     try {
-      return await fs12.promises.readFile(absoluteFilepath);
+      return await fs14.promises.readFile(absoluteFilepath);
     } catch (fsError) {
       logError(
         `[FileOperations] Failed to read ${relativeFilepath} from filesystem: ${fsError}`
@@ -13770,19 +16022,19 @@ var scanFiles = async ({
   const repoUploadInfo = await initializeSecurityReport(gqlClient, scanContext);
   const fixReportId = repoUploadInfo.fixReportId;
   const fileOperations = new FileOperations();
-  const packingResult = await fileOperations.createSourceCodeArchive(
+  const packingResult = await fileOperations.createSourceCodeArchive({
     fileList,
     repositoryPath,
-    MCP_MAX_FILE_SIZE
-  );
+    maxFileSize: MCP_MAX_FILE_SIZE
+  });
   logDebug(
     `[${scanContext}] Files ${packingResult.packedFilesCount} packed successfully, ${packingResult.totalSize} bytes`
   );
-  await uploadSourceCodeArchive(
-    packingResult.archive,
+  await uploadSourceCodeArchive({
+    archiveBuffer: packingResult.archive,
     repoUploadInfo,
     scanContext
-  );
+  });
   const projectId = await getProjectId(gqlClient, scanContext);
   const gitService = new GitService(repositoryPath);
   const { branch } = await gitService.getCurrentCommitAndBranch();
@@ -13832,7 +16084,11 @@ var initializeSecurityReport = async (gqlClient, scanContext) => {
     );
   }
 };
-var uploadSourceCodeArchive = async (archiveBuffer, repoUploadInfo, scanContext) => {
+var uploadSourceCodeArchive = async ({
+  archiveBuffer,
+  repoUploadInfo,
+  scanContext
+}) => {
   if (!repoUploadInfo) {
     throw new FileUploadError("Upload info is required for source code archive");
   }
@@ -13875,6 +16131,7 @@ var executeSecurityScan = async ({
   if (!gqlClient) {
     throw new GqlClientError();
   }
+  const scanStartTime = Date.now();
   logInfo(`[${scanContext}] Starting scan`);
   const submitVulnerabilityReportVariables = {
     fixReportId,
@@ -13973,14 +16230,17 @@ var executeSecurityScan = async ({
       `Security analysis failed: ${error.message || "Unknown error"}`
     );
   }
+  const scanDuration = Date.now() - scanStartTime;
   logDebug(`[${scanContext}] Security scan completed successfully`, {
     fixReportId,
-    projectId
+    projectId,
+    filesScanned: fileCount,
+    scanDurationMs: scanDuration
   });
 };
 
 // src/mcp/tools/checkForNewAvailableFixes/CheckForNewAvailableFixesService.ts
-function extractPathFromPatch(patch) {
+function extractPathFromPatch2(patch) {
   const match = patch?.match(/^diff --git a\/([^\s]+) b\//);
   return match?.[1] ?? null;
 }
@@ -13997,6 +16257,7 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
     __publicField(this, "reportedFixes", []);
     __publicField(this, "intervalId", null);
     __publicField(this, "isInitialScanComplete", false);
+    __publicField(this, "hasAuthenticationFailed", false);
     __publicField(this, "gqlClient", null);
     __publicField(this, "fullScanPathsScanned", []);
     this.fullScanPathsScanned = configStore.get("fullScanPathsScanned") || [];
@@ -14015,6 +16276,7 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
     this.filesLastScanned = {};
     this.freshFixes = [];
     this.reportedFixes = [];
+    this.hasAuthenticationFailed = false;
     this.fullScanPathsScanned = configStore.get("fullScanPathsScanned") || [];
     if (this.intervalId) {
       clearInterval(this.intervalId);
@@ -14026,33 +16288,40 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
    * since the last scan.
    */
   async scanForSecurityVulnerabilities({
-    path: path13,
+    path: path15,
     isAllDetectionRulesScan,
     isAllFilesScan,
     scanContext
   }) {
+    this.hasAuthenticationFailed = false;
     logDebug(`[${scanContext}] Scanning for new security vulnerabilities`, {
-      path: path13
+      path: path15
     });
     if (!this.gqlClient) {
       logInfo(`[${scanContext}] No GQL client found, skipping scan`);
+      this.hasAuthenticationFailed = true;
       throw new Error("No GQL client found");
     }
     try {
       const isConnected = await this.gqlClient.verifyApiConnection();
       if (!isConnected) {
         logError(`[${scanContext}] Failed to connect to the API, scan aborted`);
+        this.hasAuthenticationFailed = true;
         throw new ApiConnectionError();
       }
       logDebug(
         `[${scanContext}] Connected to the API, assembling list of files to scan`,
-        { path: path13 }
+        { path: path15 }
       );
       const files = await getLocalFiles({
-        path: path13,
+        path: path15,
         isAllFilesScan,
         scanContext
       });
+      const scanStartTime = Date.now();
+      logDebug(
+        `[${scanContext}] setting scan start time to ${new Date(scanStartTime).toISOString()}`
+      );
       logDebug(`[${scanContext}] Active files`, { files });
       const filesToScan = files.filter((file) => {
         const lastScannedEditTime = this.filesLastScanned[file.fullPath];
@@ -14070,13 +16339,13 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
       });
       const { fixReportId, projectId } = await scanFiles({
         fileList: filesToScan.map((file) => file.relativePath),
-        repositoryPath: path13,
+        repositoryPath: path15,
         gqlClient: this.gqlClient,
         isAllDetectionRulesScan,
         scanContext
       });
       logInfo(
-        `[${scanContext}] Security scan completed for ${path13} reportId: ${fixReportId} projectId: ${projectId}`
+        `[${scanContext}] Security scan completed for ${path15} reportId: ${fixReportId} projectId: ${projectId}`
       );
       if (isAllFilesScan) {
         return;
@@ -14092,7 +16361,43 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
       logInfo(
         `[${scanContext}] Security fixes retrieved, total: ${fixes?.fixes?.length || 0}, new: ${newFixes?.length || 0}`
       );
-      this.updateFreshFixesCache(newFixes || [], filesToScan, scanContext);
+      if (newFixes && newFixes.length > 0) {
+        try {
+          const isMvsAutoFixEnabled = await this.gqlClient.getMvsAutoFixSettings();
+          logDebug(
+            `[${scanContext}] mvs_auto_fix setting: ${isMvsAutoFixEnabled}`
+          );
+          if (isMvsAutoFixEnabled) {
+            const mvsAutoFixFilteredFixes = this.filterFixesForMvsAutoFix(
+              newFixes,
+              scanContext
+            );
+            await this.applyFixes({
+              newFixes: mvsAutoFixFilteredFixes,
+              scanContext,
+              scanStartTime
+            });
+          } else {
+            this.updateAvailableFixes({
+              newFixes,
+              scannedFiles: filesToScan,
+              scanContext
+            });
+          }
+        } catch (error) {
+          logError(
+            `[${scanContext}] Failed to check mvs_auto_fix setting, falling back to cache`,
+            {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          );
+          this.updateAvailableFixes({
+            newFixes,
+            scannedFiles: filesToScan,
+            scanContext
+          });
+        }
+      }
       this.updateFilesScanTimestamps(filesToScan);
       this.isInitialScanComplete = true;
     } catch (error) {
@@ -14104,6 +16409,7 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
             error: errorMessage
           }
         );
+        this.hasAuthenticationFailed = true;
         return;
       }
       if (errorMessage.includes("ReportInitializationError")) {
@@ -14122,8 +16428,134 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
       throw error;
     }
   }
-  updateFreshFixesCache(newFixes, filesToScan, scanContext) {
-    this.freshFixes = this.freshFixes.filter((fix) => !this.isFixFromOldScan(fix, filesToScan, scanContext)).concat(newFixes).sort((a, b) => {
+  /**
+   * Applies fixes directly to the repository when mvs_auto_fix is enabled
+   */
+  async applyFixes({
+    newFixes,
+    scanContext,
+    scanStartTime
+  }) {
+    if (newFixes.length === 0) {
+      logInfo(`[${scanContext}] No new fixes to apply (all already reported)`);
+      return;
+    }
+    logInfo(`[${scanContext}] Auto-applying ${newFixes.length} new fixes`);
+    const repositoryPath = this.path;
+    logDebug(`[${scanContext}] Repository path for patch application`, {
+      repositoryPath
+    });
+    const applicationResult = await PatchApplicationService.applyFixes({
+      fixes: newFixes,
+      repositoryPath,
+      scanStartTime,
+      gqlClient: this.gqlClient || void 0,
+      scanContext
+    });
+    if (applicationResult.appliedFixes.length > 0) {
+      logInfo(
+        `[${scanContext}] Successfully auto-applied ${applicationResult.appliedFixes.length} fixes`
+      );
+      this.reportedFixes.push(...applicationResult.appliedFixes);
+      await this.saveAndLogAppliedFixes({
+        appliedFixes: applicationResult.appliedFixes,
+        repositoryPath,
+        scanContext
+      });
+    }
+    if (applicationResult.failedFixes.length > 0) {
+      logError(
+        `[${scanContext}] Failed to auto-apply ${applicationResult.failedFixes.length} fixes`,
+        {
+          failedFixes: applicationResult.failedFixes.map((f) => ({
+            fixId: f.fix.id,
+            error: f.error
+          }))
+        }
+      );
+    }
+  }
+  /**
+   * Saves patch files and logs fix details for successfully applied fixes
+   */
+  async saveAndLogAppliedFixes({
+    appliedFixes,
+    repositoryPath,
+    scanContext
+  }) {
+    try {
+      const localMobbService = new LocalMobbFolderService(repositoryPath);
+      logDebug(
+        `[${scanContext}] Saving and logging ${appliedFixes.length} applied fixes`,
+        {
+          repositoryPath,
+          fixIds: appliedFixes.map((f) => f.id)
+        }
+      );
+      for (const fix of appliedFixes) {
+        try {
+          const saveResult = await localMobbService.savePatch(fix);
+          if (saveResult.success) {
+            logDebug(
+              `[${scanContext}] Patch saved successfully for fix ${fix.id}`,
+              {
+                filePath: saveResult.filePath,
+                fileName: saveResult.fileName
+              }
+            );
+          } else {
+            logDebug(
+              `[${scanContext}] Failed to save patch for fix ${fix.id}`,
+              {
+                error: saveResult.error
+              }
+            );
+          }
+          const logResult = await localMobbService.logPatch(
+            fix,
+            saveResult.fileName
+          );
+          if (logResult.success) {
+            logDebug(
+              `[${scanContext}] Fix details logged successfully for fix ${fix.id}`,
+              {
+                filePath: logResult.filePath
+              }
+            );
+          } else {
+            logError(
+              `[${scanContext}] Failed to log fix details for fix ${fix.id}`,
+              {
+                error: logResult.error
+              }
+            );
+          }
+        } catch (error) {
+          logError(`[${scanContext}] Error processing applied fix ${fix.id}`, {
+            error: String(error),
+            fix
+          });
+        }
+      }
+      logInfo(`[${scanContext}] Finished saving and logging applied fixes`, {
+        processedCount: appliedFixes.length
+      });
+    } catch (error) {
+      logError(`[${scanContext}] Error in saveAndLogAppliedFixes`, {
+        error: String(error),
+        repositoryPath,
+        appliedFixCount: appliedFixes.length
+      });
+    }
+  }
+  updateAvailableFixes({
+    newFixes,
+    scannedFiles,
+    scanContext
+  }) {
+    this.freshFixes = this.freshFixes.filter(
+      (fix) => !this.isFixFromOldScan({ fix, scannedFiles, scanContext })
+    ).concat(newFixes).sort((a, b) => {
       return (b.severityValue ?? 0) - (a.severityValue ?? 0);
     });
     logInfo(
@@ -14137,63 +16569,161 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
   }
   isFixAlreadyReported(fix) {
     return this.reportedFixes.some(
-      (reportedFix) => reportedFix.sharedState?.id === fix.sharedState?.id
+      (reportedFix) => reportedFix.sharedState?.id === fix.sharedState?.id || reportedFix.id === fix.id
     );
   }
-  isFixFromOldScan(fix, filesToScan, scanContext) {
+  /**
+   * Filters fixes for MVS_AUTO_FIX flow to only include fixes with:
+   * - category 'Fixable' (or no category field - backward compatibility)
+   * - do NOT have downloadSource 'AUTO_MVS'
+   */
+  filterFixesForMvsAutoFix(fixes, scanContext) {
+    const filteredFixes = fixes.filter((fix) => {
+      const hasFixableCategory = fix.vulnerabilityReportIssues?.some(
+        (issue) => !issue.category || // Handle missing field gracefully
+        issue.category === "Fixable" /* Fixable */
+      ) ?? true;
+      const hasAutoMvsDownloadSource = fix.sharedState?.downloadedBy?.some(
+        (d) => d.downloadSource === "AUTO_MVS" /* AutoMvs */
+      ) ?? false;
+      const doesNotHaveAutoMvsDownloadSource = !hasAutoMvsDownloadSource;
+      const shouldInclude = hasFixableCategory && doesNotHaveAutoMvsDownloadSource;
+      if (!shouldInclude) {
+        const filteringReasons = [];
+        if (!hasFixableCategory) {
+          filteringReasons.push("not fixable category");
+        }
+        if (!doesNotHaveAutoMvsDownloadSource) {
+          filteringReasons.push("has AUTO_MVS download source");
+        }
+        const reasonText = filteringReasons.join(" and ");
+        logDebug(
+          `[${scanContext}] Fix ${fix.id} filtered out - ${reasonText}`,
+          {
+            fixId: fix.id,
+            hasFixableCategory,
+            doesNotHaveAutoMvsDownloadSource,
+            filteringReasons,
+            categories: fix.vulnerabilityReportIssues?.map(
+              (issue) => issue.category
+            ),
+            downloadSources: fix.sharedState?.downloadedBy?.map(
+              (d) => d.downloadSource
+            )
+          }
+        );
+      }
+      return shouldInclude;
+    });
+    logInfo(`[${scanContext}] MVS_AUTO_FIX filtering completed`, {
+      originalCount: fixes.length,
+      filteredCount: filteredFixes.length,
+      removedCount: fixes.length - filteredFixes.length
+    });
+    return filteredFixes;
+  }
+  isFixFromOldScan({
+    fix,
+    scannedFiles,
+    scanContext
+  }) {
     const patch = fix.patchAndQuestions?.__typename === "FixData" ? fix.patchAndQuestions.patch : void 0;
-    const fixFile = extractPathFromPatch(patch);
+    const fixFile = extractPathFromPatch2(patch);
     if (!fixFile) {
       return false;
     }
     logDebug(`[${scanContext}] Checking if fix is from old scan`, {
       fixFile,
-      filesToScan,
-      isFromOldScan: filesToScan.some((file) => file.relativePath === fixFile)
+      scannedFiles,
+      isFromOldScan: scannedFiles.some((file) => file.relativePath === fixFile)
     });
-    return filesToScan.some((file) => file.relativePath === fixFile);
+    return scannedFiles.some((file) => file.relativePath === fixFile);
   }
-  async getFreshFixes({ path: path13 }) {
+  async getFreshFixes({ path: path15 }) {
     const scanContext = ScanContext.USER_REQUEST;
-    logDebug(`[${scanContext}] Getting fresh fixes`, { path: path13 });
-    if (this.path !== path13) {
-      this.path = path13;
+    logDebug(`[${scanContext}] Getting fresh fixes`, { path: path15 });
+    if (this.path !== path15) {
+      this.path = path15;
       this.reset();
-      logInfo(`[${scanContext}] Reset service state for new path`, { path: path13 });
+      logInfo(`[${scanContext}] Reset service state for new path`, { path: path15 });
+    }
+    try {
+      this.gqlClient = await createAuthenticatedMcpGQLClient();
+    } catch (error) {
+      const errorMessage = error.message;
+      if (errorMessage.includes("Authentication failed") || errorMessage.includes("access-denied") || errorMessage.includes("Authentication hook unauthorized")) {
+        logError(
+          `[${scanContext}] Failed to create authenticated client due to authentication failure`,
+          {
+            error: errorMessage
+          }
+        );
+        this.hasAuthenticationFailed = true;
+        return authenticationRequiredPrompt;
+      }
+      throw error;
+    }
+    this.triggerScan({ path: path15, gqlClient: this.gqlClient });
+    let isMvsAutoFixEnabled = null;
+    try {
+      isMvsAutoFixEnabled = await this.gqlClient.getMvsAutoFixSettings();
+      logDebug(`[${scanContext}] mvs_auto_fix setting: ${isMvsAutoFixEnabled}`);
+      if (isMvsAutoFixEnabled) {
+        if (this.reportedFixes.length > 0) {
+          return this.generateAppliedFixesResponse(scanContext);
+        }
+      } else {
+        if (this.freshFixes.length > 0) {
+          return this.generateFreshFixesResponse(scanContext);
+        }
+      }
+    } catch (error) {
+      logError(`[${scanContext}] Failed to check mvs_auto_fix setting`, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      if (this.freshFixes.length > 0) {
+        return this.generateFreshFixesResponse(scanContext);
+      }
     }
-    this.gqlClient = await createAuthenticatedMcpGQLClient();
-    this.triggerScan({ path: path13, gqlClient: this.gqlClient });
-    if (this.freshFixes.length > 0) {
-      return this.generateFreshFixesResponse(scanContext);
+    if (this.hasAuthenticationFailed) {
+      return authenticationRequiredPrompt;
     }
     if (!this.isInitialScanComplete) {
       return initialScanInProgressPrompt;
     }
+    if (isMvsAutoFixEnabled === true) {
+      return noVulnerabilitiesAutoFixPrompt;
+    }
     return noFreshFixesPrompt;
   }
   triggerScan({
-    path: path13,
+    path: path15,
     gqlClient
   }) {
+    if (this.path !== path15) {
+      this.path = path15;
+      this.reset();
+      logInfo(`Reset service state for new path in triggerScan`, { path: path15 });
+    }
     this.gqlClient = gqlClient;
     if (!this.intervalId) {
-      this.startPeriodicScanning(path13);
-      this.executeInitialScan(path13);
-      void this.executeInitialFullScan(path13);
+      this.startPeriodicScanning(path15);
+      this.executeInitialScan(path15);
+      void this.executeInitialFullScan(path15);
     }
   }
-  startPeriodicScanning(path13) {
+  startPeriodicScanning(path15) {
     const scanContext = ScanContext.BACKGROUND_PERIODIC;
     logDebug(
       `[${scanContext}] Starting periodic scan for new security vulnerabilities`,
       {
-        path: path13
+        path: path15
       }
     );
     this.intervalId = setInterval(() => {
-      logDebug(`[${scanContext}] Triggering periodic security scan`, { path: path13 });
+      logDebug(`[${scanContext}] Triggering periodic security scan`, { path: path15 });
       this.scanForSecurityVulnerabilities({
-        path: path13,
+        path: path15,
         scanContext
       }).catch((error) => {
         logError(`[${scanContext}] Error during periodic security scan`, {
@@ -14202,45 +16732,45 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
       });
     }, MCP_PERIODIC_CHECK_INTERVAL);
   }
-  async executeInitialFullScan(path13) {
+  async executeInitialFullScan(path15) {
     const scanContext = ScanContext.FULL_SCAN;
-    logDebug(`[${scanContext}] Triggering initial full security scan`, { path: path13 });
+    logDebug(`[${scanContext}] Triggering initial full security scan`, { path: path15 });
     logDebug(`[${scanContext}] Full scan paths scanned`, {
       fullScanPathsScanned: this.fullScanPathsScanned
     });
-    if (this.fullScanPathsScanned.includes(path13)) {
+    if (this.fullScanPathsScanned.includes(path15)) {
       logDebug(`[${scanContext}] Full scan already executed for this path`, {
-        path: path13
+        path: path15
       });
       return;
     }
     configStore.set("fullScanPathsScanned", [
       ...this.fullScanPathsScanned,
-      path13
+      path15
     ]);
     try {
       await this.scanForSecurityVulnerabilities({
-        path: path13,
+        path: path15,
         isAllFilesScan: true,
         isAllDetectionRulesScan: true,
         scanContext: ScanContext.FULL_SCAN
       });
-      if (!this.fullScanPathsScanned.includes(path13)) {
-        this.fullScanPathsScanned.push(path13);
+      if (!this.fullScanPathsScanned.includes(path15)) {
+        this.fullScanPathsScanned.push(path15);
         configStore.set("fullScanPathsScanned", this.fullScanPathsScanned);
       }
-      logInfo(`[${scanContext}] Full scan completed`, { path: path13 });
+      logInfo(`[${scanContext}] Full scan completed`, { path: path15 });
     } catch (error) {
       logError(`[${scanContext}] Error during initial full security scan`, {
         error
       });
     }
   }
-  executeInitialScan(path13) {
+  executeInitialScan(path15) {
     const scanContext = ScanContext.BACKGROUND_INITIAL;
-    logDebug(`[${scanContext}] Triggering initial security scan`, { path: path13 });
+    logDebug(`[${scanContext}] Triggering initial security scan`, { path: path15 });
     this.scanForSecurityVulnerabilities({
-      path: path13,
+      path: path15,
       scanContext: ScanContext.BACKGROUND_INITIAL
     }).catch((error) => {
       logError(`[${scanContext}] Error during initial security scan`, { error });
@@ -14262,6 +16792,20 @@ var _CheckForNewAvailableFixesService = class _CheckForNewAvailableFixesService
     logInfo(`[${scanContext}] No fresh fixes to report`);
     return noFreshFixesPrompt;
   }
+  generateAppliedFixesResponse(scanContext = ScanContext.USER_REQUEST) {
+    const appliedFixesToShow = this.reportedFixes;
+    if (appliedFixesToShow.length > 0) {
+      logInfo(
+        `[${scanContext}] Reporting ${appliedFixesToShow.length} applied fixes to user`
+      );
+      return appliedFixesSummaryPrompt({
+        fixes: appliedFixesToShow,
+        gqlClient: this.gqlClient
+      });
+    }
+    logInfo(`[${scanContext}] No applied fixes to report`);
+    return noFreshFixesPrompt;
+  }
 };
 __publicField(_CheckForNewAvailableFixesService, "instance");
 var CheckForNewAvailableFixesService = _CheckForNewAvailableFixesService;
@@ -14285,8 +16829,10 @@ How to invoke:
   \u2013 path (string): absolute path to the repository root.
 
 Behaviour:
-\u2022 If no new fixes are available, it returns a concise message indicating so.
-\u2022 If fixes are found, it returns a human-readable summary including total count and severity breakdown.
+\u2022 If auto-fix is enabled: Returns a list of fixes that were automatically applied to your codebase.
+\u2022 If auto-fix is disabled: Returns a list of fresh fixes available for manual review and application.
+\u2022 If no fixes are available, it returns a concise message indicating so.
+\u2022 Results include a human-readable summary with total count and severity breakdown.
 
 Example payload:
 {
@@ -14302,8 +16848,8 @@ Example payload:
       },
       required: ["path"]
     });
-    __publicField(this, "inputValidationSchema", z32.object({
-      path: z32.string().describe(
+    __publicField(this, "inputValidationSchema", z34.object({
+      path: z34.string().describe(
         "Full local path to the cloned git repository to check for new available fixes"
       )
     }));
@@ -14320,9 +16866,9 @@ Example payload:
         `Invalid path: potential security risk detected in path: ${pathValidationResult.error}`
       );
     }
-    const path13 = pathValidationResult.path;
+    const path15 = pathValidationResult.path;
     const resultText = await this.newFixesService.getFreshFixes({
-      path: path13
+      path: path15
     });
     logInfo("CheckForNewAvailableFixesTool execution completed", {
       resultText
@@ -14333,7 +16879,7 @@ Example payload:
 
 // src/mcp/tools/fetchAvailableFixes/FetchAvailableFixesTool.ts
 init_GitService();
-import { z as z33 } from "zod";
+import { z as z35 } from "zod";
 
 // src/mcp/tools/fetchAvailableFixes/FetchAvailableFixesService.ts
 init_configs();
@@ -14452,12 +16998,12 @@ Call this tool instead of ${MCP_TOOL_SCAN_AND_FIX_VULNERABILITIES} when you only
       },
       required: ["path"]
     });
-    __publicField(this, "inputValidationSchema", z33.object({
-      path: z33.string().describe(
+    __publicField(this, "inputValidationSchema", z35.object({
+      path: z35.string().describe(
         "Full local path to the cloned git repository to check for available fixes"
       ),
-      offset: z33.number().optional().describe("Optional offset for pagination"),
-      limit: z33.number().optional().describe("Optional maximum number of fixes to return")
+      offset: z35.number().optional().describe("Optional offset for pagination"),
+      limit: z35.number().optional().describe("Optional maximum number of fixes to return")
     }));
     __publicField(this, "availableFixesService");
     this.availableFixesService = FetchAvailableFixesService.getInstance();
@@ -14470,8 +17016,8 @@ Call this tool instead of ${MCP_TOOL_SCAN_AND_FIX_VULNERABILITIES} when you only
         `Invalid path: potential security risk detected in path: ${pathValidationResult.error}`
       );
     }
-    const path13 = pathValidationResult.path;
-    const gitService = new GitService(path13, log);
+    const path15 = pathValidationResult.path;
+    const gitService = new GitService(path15, log);
     const gitValidation = await gitService.validateRepository();
     if (!gitValidation.isValid) {
       throw new Error(`Invalid git repository: ${gitValidation.error}`);
@@ -14498,7 +17044,7 @@ Call this tool instead of ${MCP_TOOL_SCAN_AND_FIX_VULNERABILITIES} when you only
 
 // src/mcp/tools/scanAndFixVulnerabilities/ScanAndFixVulnerabilitiesTool.ts
 init_configs();
-import z34 from "zod";
+import z36 from "zod";
 
 // src/mcp/tools/scanAndFixVulnerabilities/ScanAndFixVulnerabilitiesService.ts
 init_configs();
@@ -14573,11 +17119,11 @@ var _ScanAndFixVulnerabilitiesService = class _ScanAndFixVulnerabilitiesService
       const effectiveOffset = offset ?? (this.currentOffset || 0);
       const effectiveLimit = limit ?? MCP_DEFAULT_LIMIT;
       logDebug("effectiveOffset", { effectiveOffset });
-      const fixes = await this.getReportFixes(
+      const fixes = await this.getReportFixes({
         fixReportId,
-        effectiveOffset,
-        effectiveLimit
-      );
+        offset: effectiveOffset,
+        limit: effectiveLimit
+      });
       logInfo(`Found ${fixes.totalCount} fixes`);
       if (fixes.totalCount > 0) {
         this.storedFixReportId = fixReportId;
@@ -14617,7 +17163,11 @@ var _ScanAndFixVulnerabilitiesService = class _ScanAndFixVulnerabilitiesService
     this.gqlClient = gqlClient;
     return gqlClient;
   }
-  async getReportFixes(fixReportId, offset, limit) {
+  async getReportFixes({
+    fixReportId,
+    offset,
+    limit
+  }) {
     logDebug("getReportFixes", { fixReportId, offset, limit });
     if (!this.gqlClient) {
       throw new GqlClientError();
@@ -14679,16 +17229,16 @@ Example payload:
   "maxFiles": 50,
   "rescan": false
 }`);
-    __publicField(this, "inputValidationSchema", z34.object({
-      path: z34.string().describe(
+    __publicField(this, "inputValidationSchema", z36.object({
+      path: z36.string().describe(
         "Full local path to repository to scan and fix vulnerabilities"
       ),
-      offset: z34.number().optional().describe("Optional offset for pagination"),
-      limit: z34.number().optional().describe("Optional maximum number of results to return"),
-      maxFiles: z34.number().optional().describe(
+      offset: z36.number().optional().describe("Optional offset for pagination"),
+      limit: z36.number().optional().describe("Optional maximum number of results to return"),
+      maxFiles: z36.number().optional().describe(
         `Optional maximum number of files to scan (default: ${MCP_DEFAULT_MAX_FILES_TO_SCAN}). Increase for comprehensive scans of larger codebases or decrease for faster focused scans.`
       ),
-      rescan: z34.boolean().optional().describe("Optional whether to rescan the repository")
+      rescan: z36.boolean().optional().describe("Optional whether to rescan the repository")
     }));
     __publicField(this, "inputSchema", {
       type: "object",
@@ -14733,9 +17283,9 @@ Example payload:
         `Invalid path: potential security risk detected in path: ${pathValidationResult.error}`
       );
     }
-    const path13 = pathValidationResult.path;
+    const path15 = pathValidationResult.path;
     const files = await getLocalFiles({
-      path: path13,
+      path: path15,
       maxFileSize: MCP_MAX_FILE_SIZE,
       maxFiles: args.maxFiles,
       scanContext: ScanContext.USER_REQUEST
@@ -14754,7 +17304,7 @@ Example payload:
     try {
       const fixResult = await this.vulnerabilityFixService.processVulnerabilities({
         fileList: files.map((file) => file.relativePath),
-        repositoryPath: path13,
+        repositoryPath: path15,
         offset: args.offset,
         limit: args.limit,
         isRescan: args.rescan || !!args.maxFiles
@@ -14835,7 +17385,7 @@ var mcpHandler = async (_args) => {
 };
 
 // src/args/commands/review.ts
-import fs13 from "fs";
+import fs15 from "fs";
 import chalk9 from "chalk";
 function reviewBuilder(yargs2) {
   return yargs2.option("f", {
@@ -14872,7 +17422,7 @@ function reviewBuilder(yargs2) {
   ).help();
 }
 function validateReviewOptions(argv) {
-  if (!fs13.existsSync(argv.f)) {
+  if (!fs15.existsSync(argv.f)) {
     throw new CliError(`
 Can't access ${chalk9.bold(argv.f)}`);
   }