mobbdev 1.3.7 → 1.4.1

package/dist/args/commands/upload_ai_blame.d.mts

@@ -56,61 +56,61 @@ declare const PromptItemZ: z.ZodObject<{
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     }, {
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     type: "USER_PROMPT" | "AI_RESPONSE" | "TOOL_EXECUTION" | "AI_THINKING" | "MCP_TOOL_CALL";
-    date?: Date | undefined;
-    attachedFiles?: {
-        relativePath: string;
-        startLine?: number | undefined;
-    }[] | undefined;
-    tokens?: {
-        inputCount: number;
-        outputCount: number;
-    } | undefined;
-    text?: string | undefined;
     tool?: {
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     } | undefined;
-}, {
-    type: "USER_PROMPT" | "AI_RESPONSE" | "TOOL_EXECUTION" | "AI_THINKING" | "MCP_TOOL_CALL";
     date?: Date | undefined;
-    attachedFiles?: {
-        relativePath: string;
-        startLine?: number | undefined;
-    }[] | undefined;
     tokens?: {
         inputCount: number;
         outputCount: number;
     } | undefined;
     text?: string | undefined;
+    attachedFiles?: {
+        relativePath: string;
+        startLine?: number | undefined;
+    }[] | undefined;
+}, {
+    type: "USER_PROMPT" | "AI_RESPONSE" | "TOOL_EXECUTION" | "AI_THINKING" | "MCP_TOOL_CALL";
     tool?: {
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     } | undefined;
+    date?: Date | undefined;
+    tokens?: {
+        inputCount: number;
+        outputCount: number;
+    } | undefined;
+    text?: string | undefined;
+    attachedFiles?: {
+        relativePath: string;
+        startLine?: number | undefined;
+    }[] | undefined;
 }>;
 type PromptItem = z.infer<typeof PromptItemZ>;
 declare const PromptItemArrayZ: z.ZodArray<z.ZodObject<{
@@ -149,61 +149,61 @@ declare const PromptItemArrayZ: z.ZodArray<z.ZodObject<{
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     }, {
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     type: "USER_PROMPT" | "AI_RESPONSE" | "TOOL_EXECUTION" | "AI_THINKING" | "MCP_TOOL_CALL";
-    date?: Date | undefined;
-    attachedFiles?: {
-        relativePath: string;
-        startLine?: number | undefined;
-    }[] | undefined;
-    tokens?: {
-        inputCount: number;
-        outputCount: number;
-    } | undefined;
-    text?: string | undefined;
     tool?: {
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     } | undefined;
-}, {
-    type: "USER_PROMPT" | "AI_RESPONSE" | "TOOL_EXECUTION" | "AI_THINKING" | "MCP_TOOL_CALL";
     date?: Date | undefined;
-    attachedFiles?: {
-        relativePath: string;
-        startLine?: number | undefined;
-    }[] | undefined;
     tokens?: {
         inputCount: number;
         outputCount: number;
     } | undefined;
     text?: string | undefined;
+    attachedFiles?: {
+        relativePath: string;
+        startLine?: number | undefined;
+    }[] | undefined;
+}, {
+    type: "USER_PROMPT" | "AI_RESPONSE" | "TOOL_EXECUTION" | "AI_THINKING" | "MCP_TOOL_CALL";
     tool?: {
         name: string;
         parameters: string;
         result: string;
-        rawArguments?: string | undefined;
         accepted?: boolean | undefined;
+        rawArguments?: string | undefined;
         mcpServer?: string | undefined;
         mcpToolName?: string | undefined;
     } | undefined;
+    date?: Date | undefined;
+    tokens?: {
+        inputCount: number;
+        outputCount: number;
+    } | undefined;
+    text?: string | undefined;
+    attachedFiles?: {
+        relativePath: string;
+        startLine?: number | undefined;
+    }[] | undefined;
 }>, "many">;
 type PromptItemArray = z.infer<typeof PromptItemArrayZ>;
 /**

package/dist/args/commands/upload_ai_blame.mjs

@@ -129,10 +129,13 @@ function getSdk(client, withWrapper = defaultWrapper) {
     },
     ScanSkill(variables, requestHeaders, signal) {
       return withWrapper((wrappedRequestHeaders) => client.request({ document: ScanSkillDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "ScanSkill", "mutation", variables);
+    },
+    SkillVerdictsByMd5(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: SkillVerdictsByMd5Document, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "SkillVerdictsByMd5", "query", variables);
     }
   };
 }
-var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, IssueType_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, defaultWrapper;
+var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, IssueType_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, defaultWrapper;
 var init_client_generates = __esm({
   "src/features/analysis/scm/generates/client_generates.ts"() {
     "use strict";
@@ -260,10 +263,12 @@ var init_client_generates = __esm({
       IssueType_Enum2["ImproperExceptionHandling"] = "IMPROPER_EXCEPTION_HANDLING";
       IssueType_Enum2["ImproperResourceShutdownOrRelease"] = "IMPROPER_RESOURCE_SHUTDOWN_OR_RELEASE";
       IssueType_Enum2["ImproperStringFormatting"] = "IMPROPER_STRING_FORMATTING";
+      IssueType_Enum2["ImproperValidationOfArrayIndex"] = "IMPROPER_VALIDATION_OF_ARRAY_INDEX";
       IssueType_Enum2["IncompleteHostnameRegex"] = "INCOMPLETE_HOSTNAME_REGEX";
       IssueType_Enum2["IncompleteSanitization"] = "INCOMPLETE_SANITIZATION";
       IssueType_Enum2["IncompleteUrlSanitization"] = "INCOMPLETE_URL_SANITIZATION";
       IssueType_Enum2["IncompleteUrlSchemeCheck"] = "INCOMPLETE_URL_SCHEME_CHECK";
+      IssueType_Enum2["IncorrectIntegerConversion"] = "INCORRECT_INTEGER_CONVERSION";
       IssueType_Enum2["IncorrectSqlApiUsage"] = "INCORRECT_SQL_API_USAGE";
       IssueType_Enum2["InformationExposureViaHeaders"] = "INFORMATION_EXPOSURE_VIA_HEADERS";
       IssueType_Enum2["InsecureBinderConfiguration"] = "INSECURE_BINDER_CONFIGURATION";
@@ -288,6 +293,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["MissingUser"] = "MISSING_USER";
       IssueType_Enum2["MissingWhitespace"] = "MISSING_WHITESPACE";
       IssueType_Enum2["MissingWorkflowPermissions"] = "MISSING_WORKFLOW_PERMISSIONS";
+      IssueType_Enum2["MissingXFrameOptions"] = "MISSING_X_FRAME_OPTIONS";
       IssueType_Enum2["ModifiedDefaultParam"] = "MODIFIED_DEFAULT_PARAM";
       IssueType_Enum2["NonFinalPublicStaticField"] = "NON_FINAL_PUBLIC_STATIC_FIELD";
       IssueType_Enum2["NonReadonlyField"] = "NON_READONLY_FIELD";
@@ -405,6 +411,7 @@ var init_client_generates = __esm({
       return Vulnerability_Report_Issue_Tag_Enum3;
     })(Vulnerability_Report_Issue_Tag_Enum || {});
     Vulnerability_Report_Vendor_Enum = /* @__PURE__ */ ((Vulnerability_Report_Vendor_Enum3) => {
+      Vulnerability_Report_Vendor_Enum3["BlackDuck"] = "blackDuck";
       Vulnerability_Report_Vendor_Enum3["Checkmarx"] = "checkmarx";
       Vulnerability_Report_Vendor_Enum3["CheckmarxXml"] = "checkmarxXml";
       Vulnerability_Report_Vendor_Enum3["Codeql"] = "codeql";
@@ -1265,6 +1272,18 @@ var init_client_generates = __esm({
     cached
     summary
   }
+}
+    `;
+    SkillVerdictsByMd5Document = `
+    query SkillVerdictsByMd5($md5s: [String!]!) {
+  skillVerdictsByMd5(md5s: $md5s) {
+    md5
+    verdict
+    summary
+    scannerName
+    scannerVersion
+    scannedAt
+  }
 }
     `;
     defaultWrapper = (action, _operationName, _operationType, _variables) => action();
@@ -1760,7 +1779,10 @@ var init_getIssueType = __esm({
       ["REDUNDANT_NIL_ERROR_CHECK" /* RedundantNilErrorCheck */]: "Redundant Nil Error Check",
       ["MISSING_WORKFLOW_PERMISSIONS" /* MissingWorkflowPermissions */]: "Missing Workflow Permissions",
       ["EXCESSIVE_SECRETS_EXPOSURE" /* ExcessiveSecretsExposure */]: "Excessive Secrets Exposure",
-      ["TAINTED_NUMERIC_CAST" /* TaintedNumericCast */]: "Tainted Numeric Cast"
+      ["TAINTED_NUMERIC_CAST" /* TaintedNumericCast */]: "Tainted Numeric Cast",
+      ["MISSING_X_FRAME_OPTIONS" /* MissingXFrameOptions */]: "Missing X-Frame-Options Header",
+      ["IMPROPER_VALIDATION_OF_ARRAY_INDEX" /* ImproperValidationOfArrayIndex */]: "Improper Validation of Array Index",
+      ["INCORRECT_INTEGER_CONVERSION" /* IncorrectIntegerConversion */]: "Incorrect Integer Conversion"
     };
     issueTypeZ = z5.nativeEnum(IssueType_Enum);
     getIssueTypeFriendlyString = (issueType) => {
@@ -4335,7 +4357,8 @@ var SCANNERS = {
   Snyk: "snyk",
   Sonarqube: "sonarqube",
   Semgrep: "semgrep",
-  Datadog: "datadog"
+  Datadog: "datadog",
+  BlackDuck: "blackduck"
 };
 var scannerToVulnerabilityReportVendorEnum = {
   [SCANNERS.Checkmarx]: "checkmarx" /* Checkmarx */,
@@ -4344,7 +4367,8 @@ var scannerToVulnerabilityReportVendorEnum = {
   [SCANNERS.Codeql]: "codeql" /* Codeql */,
   [SCANNERS.Fortify]: "fortify" /* Fortify */,
   [SCANNERS.Semgrep]: "semgrep" /* Semgrep */,
-  [SCANNERS.Datadog]: "datadog" /* Datadog */
+  [SCANNERS.Datadog]: "datadog" /* Datadog */,
+  [SCANNERS.BlackDuck]: "blackDuck" /* BlackDuck */
 };
 var SupportedScannersZ = z8.enum([SCANNERS.Checkmarx, SCANNERS.Snyk]);
 var envVariablesSchema = z8.object({
@@ -4927,7 +4951,10 @@ var fixDetailsData = {
   ["REDUNDANT_NIL_ERROR_CHECK" /* RedundantNilErrorCheck */]: void 0,
   ["MISSING_WORKFLOW_PERMISSIONS" /* MissingWorkflowPermissions */]: void 0,
   ["EXCESSIVE_SECRETS_EXPOSURE" /* ExcessiveSecretsExposure */]: void 0,
-  ["TAINTED_NUMERIC_CAST" /* TaintedNumericCast */]: void 0
+  ["TAINTED_NUMERIC_CAST" /* TaintedNumericCast */]: void 0,
+  ["MISSING_X_FRAME_OPTIONS" /* MissingXFrameOptions */]: void 0,
+  ["IMPROPER_VALIDATION_OF_ARRAY_INDEX" /* ImproperValidationOfArrayIndex */]: void 0,
+  ["INCORRECT_INTEGER_CONVERSION" /* IncorrectIntegerConversion */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/commitDescriptionMarkup.ts
@@ -6177,6 +6204,19 @@ var headerMaxAge = {
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/js/missingXFrameOptions.ts
+var xFrameOptionsValue = {
+  xFrameOptionsValue: {
+    content: () => "Please provide the value for the X-Frame-Options header",
+    description: () => `The \`X-Frame-Options\` HTTP response header tells the browser whether the page is allowed to be rendered inside a \`<frame>\`, \`<iframe>\`, \`<embed>\` or \`<object>\`. Without it, attackers can embed your application in an invisible iframe and trick users into clicking on it \u2014 a class of attacks known as clickjacking (UI redressing).    
+&nbsp;    
+&nbsp;    **Allowed values:**    
+&nbsp;    - \`DENY\` \u2014 the page cannot be framed by any site, including your own. Recommended default for any page that does not need to be embedded.    
+&nbsp;    - \`SAMEORIGIN\` \u2014 the page can only be framed by pages served from the same origin. Use this only if your own application legitimately embeds this page in an iframe.`,
+    guidance: () => ``
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/js/noLimitsOrThrottling.ts
 var noLimitsOrThrottling2 = {
   setGlobalLimiter: {
@@ -6321,6 +6361,7 @@ var vulnerabilities13 = {
   ["UNCHECKED_LOOP_CONDITION" /* UncheckedLoopCondition */]: uncheckedLoopCondition2,
   ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling2,
   ["MISSING_CSP_HEADER" /* MissingCspHeader */]: cspHeaderValue,
+  ["MISSING_X_FRAME_OPTIONS" /* MissingXFrameOptions */]: xFrameOptionsValue,
   ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: hardcodedDomainInHtml,
   ["CSRF" /* Csrf */]: csrf2
 };
@@ -6502,6 +6543,13 @@ var ReferenceType = /* @__PURE__ */ ((ReferenceType2) => {
   ReferenceType2["TAG"] = "TAG";
   return ReferenceType2;
 })(ReferenceType || {});
+var GithubFullShaZ = z14.string().regex(/^[a-f0-9]{40}$/);
+var MergedPrSurvivalMetadataZ = z14.object({
+  mergeCommitShas: z14.array(GithubFullShaZ).min(1).refine((shas) => new Set(shas).size === shas.length, {
+    message: "mergeCommitShas must contain unique SHAs"
+  }),
+  targetBranch: z14.string().min(1)
+});
 var scmCloudHostname = {
   ["GitLab" /* GitLab */]: new URL(scmCloudUrl.GitLab).hostname,
   ["GitHub" /* GitHub */]: new URL(scmCloudUrl.GitHub).hostname,
@@ -7233,6 +7281,10 @@ var GQLClient = class {
   async scanSkill(variables) {
     return await this._clientSdk.ScanSkill(variables);
   }
+  // T-467 — batched verdict lookup for the client-side quarantine check.
+  async skillVerdictsByMd5(md5s) {
+    return await this._clientSdk.SkillVerdictsByMd5({ md5s });
+  }
 };
 
 // src/features/analysis/graphql/tracy-batch-upload.ts