mobbdev 1.4.26 → 1.4.28

package/dist/args/commands/upload_ai_blame.d.mts

@@ -221,13 +221,18 @@ type RepoState = {
  * `GitService.getCurrentRepoState()` so detached-HEAD handling and SHA
  * normalization stay in lockstep across the two clients.
  *
- * Never throws — non-existent dirs, missing git binaries, and unrecognized
- * remotes all resolve to nulls so the daemon hot path can rely on a value.
+ * The repository URL is the canonical form (parseScmURL().canonicalUrl) for any
+ * SCM host, including self-hosted / enterprise remotes (scmType "Unknown"); only
+ * an absent or genuinely unparseable remote resolves to `repositoryUrl: null`.
+ *
+ * Never throws — a non-existent dir, missing git binary, or absent/unparseable
+ * remote resolves to null so the daemon hot path can rely on a value.
  */
 declare function readRepoState(workingDir?: string): Promise<RepoState>;
 /**
- * Gets the normalized GitHub repository URL from the current working directory.
- * Returns null if not in a git repository or if not a GitHub repository.
+ * Gets the canonical remote repository URL for the working directory's repo, for
+ * any SCM host (GitHub, GitLab, Azure DevOps, Bitbucket, and self-hosted /
+ * enterprise). Returns null when there is no remote or it can't be parsed.
  */
 declare function getRepositoryUrl(workingDir?: string): Promise<string | null>;
 /**

package/dist/args/commands/upload_ai_blame.mjs

@@ -357,6 +357,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["TrustBoundaryViolation"] = "TRUST_BOUNDARY_VIOLATION";
       IssueType_Enum2["TypeConfusion"] = "TYPE_CONFUSION";
       IssueType_Enum2["UncheckedLoopCondition"] = "UNCHECKED_LOOP_CONDITION";
+      IssueType_Enum2["UncheckedReturnValue"] = "UNCHECKED_RETURN_VALUE";
       IssueType_Enum2["UnencryptedAwsSqsQueue"] = "UNENCRYPTED_AWS_SQS_QUEUE";
       IssueType_Enum2["UnnecessaryImports"] = "UNNECESSARY_IMPORTS";
       IssueType_Enum2["UnsafeDeserialization"] = "UNSAFE_DESERIALIZATION";
@@ -1930,7 +1931,8 @@ var init_getIssueType = __esm({
       ["UNENCRYPTED_AWS_SQS_QUEUE" /* UnencryptedAwsSqsQueue */]: "AWS SQS Queue Unencrypted",
       ["INSECURE_DESERIALIZATION" /* InsecureDeserialization */]: "Insecure Deserialization",
       ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: "AWS DynamoDB Point-in-Time Recovery Disabled",
-      ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: "JWT Decoded Without Signature Verification"
+      ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: "JWT Decoded Without Signature Verification",
+      ["UNCHECKED_RETURN_VALUE" /* UncheckedReturnValue */]: "Unchecked Return Value"
     };
     issueTypeZ = z5.nativeEnum(IssueType_Enum);
     getIssueTypeFriendlyString = (issueType) => {
@@ -5188,7 +5190,8 @@ var fixDetailsData = {
   ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: {
     issueDescription: "Decoding a JWT with `JWT.decode()` only base64-decodes the token without checking its signature, so an attacker can forge a token with arbitrary claims (identity, roles, expiration) and have it trusted. CWE-345, OWASP A08:2021 Software and Data Integrity Failures.",
     fixInstructions: "Verify the signature before trusting any claims: build a verifier with the expected algorithm and secret/key (e.g. `JWT.require(Algorithm.HMAC256(secret)).build().verify(token)`) instead of calling `JWT.decode(token)`. After merging, confirm the verifier is configured with the same algorithm and secret/key used to sign your tokens \u2014 an incorrect or placeholder secret will make verification throw `JWTVerificationException` at runtime and reject legitimate tokens."
-  }
+  },
+  ["UNCHECKED_RETURN_VALUE" /* UncheckedReturnValue */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/commitDescriptionMarkup.ts
@@ -7826,6 +7829,19 @@ import Debug8 from "debug";
 import Debug7 from "debug";
 import fetch3, { File, fileFrom, FormData } from "node-fetch";
 var debug8 = Debug7("mobbdev:upload-file");
+var MIN_UPLOAD_TIMEOUT_MS = 1e4;
+var MAX_UPLOAD_TIMEOUT_MS = 6e4;
+var SLOW_LINK_BYTES_PER_MS = 512;
+function computeUploadTimeoutMs(file) {
+  if (typeof file === "string") {
+    return MAX_UPLOAD_TIMEOUT_MS;
+  }
+  const sizeAllowanceMs = Math.ceil(file.byteLength / SLOW_LINK_BYTES_PER_MS);
+  return Math.min(
+    MAX_UPLOAD_TIMEOUT_MS,
+    MIN_UPLOAD_TIMEOUT_MS + sizeAllowanceMs
+  );
+}
 var S3UploadError = class extends Error {
   constructor(status, s3Code, s3Message) {
     super(`Failed to upload the file: ${status}`);
@@ -7884,11 +7900,12 @@ async function uploadFile({
     );
   }
   const agent = getProxyAgent(url);
+  const effectiveSignal = signal ?? AbortSignal.timeout(computeUploadTimeoutMs(file));
   const response = await fetch3(url, {
     method: "POST",
     body: form,
     agent,
-    signal
+    signal: effectiveSignal
   });
   if (!response.ok) {
     let bodyText = "";
@@ -8465,8 +8482,7 @@ async function readRepoState(workingDir) {
   const repoStatePromise = gitService.getCurrentRepoState().catch(() => ({ branch: null, commitSha: null }));
   const repositoryUrlPromise = gitService.getRemoteUrl().then((url) => {
     if (!url) return null;
-    const parsed = parseScmURL(url);
-    return parsed?.scmType && parsed.scmType !== "Unknown" ? url : null;
+    return parseScmURL(url)?.canonicalUrl ?? null;
   }).catch(() => null);
   const [{ branch, commitSha }, repositoryUrl] = await Promise.all([
     repoStatePromise,

package/dist/index.mjs

@@ -357,6 +357,7 @@ var init_client_generates = __esm({
       IssueType_Enum2["TrustBoundaryViolation"] = "TRUST_BOUNDARY_VIOLATION";
       IssueType_Enum2["TypeConfusion"] = "TYPE_CONFUSION";
       IssueType_Enum2["UncheckedLoopCondition"] = "UNCHECKED_LOOP_CONDITION";
+      IssueType_Enum2["UncheckedReturnValue"] = "UNCHECKED_RETURN_VALUE";
       IssueType_Enum2["UnencryptedAwsSqsQueue"] = "UNENCRYPTED_AWS_SQS_QUEUE";
       IssueType_Enum2["UnnecessaryImports"] = "UNNECESSARY_IMPORTS";
       IssueType_Enum2["UnsafeDeserialization"] = "UNSAFE_DESERIALIZATION";
@@ -1595,7 +1596,8 @@ var init_getIssueType = __esm({
       ["UNENCRYPTED_AWS_SQS_QUEUE" /* UnencryptedAwsSqsQueue */]: "AWS SQS Queue Unencrypted",
       ["INSECURE_DESERIALIZATION" /* InsecureDeserialization */]: "Insecure Deserialization",
       ["AWS_DYNAMODB_POINT_IN_TIME_RECOVERY_DISABLED" /* AwsDynamodbPointInTimeRecoveryDisabled */]: "AWS DynamoDB Point-in-Time Recovery Disabled",
-      ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: "JWT Decoded Without Signature Verification"
+      ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: "JWT Decoded Without Signature Verification",
+      ["UNCHECKED_RETURN_VALUE" /* UncheckedReturnValue */]: "Unchecked Return Value"
     };
     issueTypeZ = z.nativeEnum(IssueType_Enum);
     getIssueTypeFriendlyString = (issueType) => {
@@ -4893,7 +4895,8 @@ var fixDetailsData = {
   ["JWT_DECODE_WITHOUT_VERIFY" /* JwtDecodeWithoutVerify */]: {
     issueDescription: "Decoding a JWT with `JWT.decode()` only base64-decodes the token without checking its signature, so an attacker can forge a token with arbitrary claims (identity, roles, expiration) and have it trusted. CWE-345, OWASP A08:2021 Software and Data Integrity Failures.",
     fixInstructions: "Verify the signature before trusting any claims: build a verifier with the expected algorithm and secret/key (e.g. `JWT.require(Algorithm.HMAC256(secret)).build().verify(token)`) instead of calling `JWT.decode(token)`. After merging, confirm the verifier is configured with the same algorithm and secret/key used to sign your tokens \u2014 an incorrect or placeholder secret will make verification throw `JWTVerificationException` at runtime and reject legitimate tokens."
-  }
+  },
+  ["UNCHECKED_RETURN_VALUE" /* UncheckedReturnValue */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/commitDescriptionMarkup.ts
@@ -14206,6 +14209,41 @@ init_urlParser2();
 import Debug8 from "debug";
 import fetch3, { File, fileFrom, FormData } from "node-fetch";
 var debug9 = Debug8("mobbdev:upload-file");
+var MIN_UPLOAD_TIMEOUT_MS = 1e4;
+var MAX_UPLOAD_TIMEOUT_MS = 6e4;
+var SLOW_LINK_BYTES_PER_MS = 512;
+function computeUploadTimeoutMs(file) {
+  if (typeof file === "string") {
+    return MAX_UPLOAD_TIMEOUT_MS;
+  }
+  const sizeAllowanceMs = Math.ceil(file.byteLength / SLOW_LINK_BYTES_PER_MS);
+  return Math.min(
+    MAX_UPLOAD_TIMEOUT_MS,
+    MIN_UPLOAD_TIMEOUT_MS + sizeAllowanceMs
+  );
+}
+var TRANSIENT_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ECONNREFUSED",
+  "EPIPE",
+  "EAI_AGAIN",
+  "ENETUNREACH",
+  "ENOTFOUND"
+]);
+function isTransientUploadError(err) {
+  if (err instanceof S3UploadError) {
+    return false;
+  }
+  if (typeof err !== "object" || err === null) {
+    return false;
+  }
+  const e = err;
+  if (e.code !== void 0 && TRANSIENT_ERROR_CODES.has(e.code)) {
+    return true;
+  }
+  return e.type === "system" || e.name === "AbortError" || e.name === "TimeoutError";
+}
 var S3UploadError = class extends Error {
   constructor(status, s3Code, s3Message) {
     super(`Failed to upload the file: ${status}`);
@@ -14264,11 +14302,12 @@ async function uploadFile({
     );
   }
   const agent = getProxyAgent(url);
+  const effectiveSignal = signal ?? AbortSignal.timeout(computeUploadTimeoutMs(file));
   const response = await fetch3(url, {
     method: "POST",
     body: form,
     agent,
-    signal
+    signal: effectiveSignal
   });
   if (!response.ok) {
     let bodyText = "";
@@ -14650,8 +14689,7 @@ async function readRepoState(workingDir) {
   const repoStatePromise = gitService.getCurrentRepoState().catch(() => ({ branch: null, commitSha: null }));
   const repositoryUrlPromise = gitService.getRemoteUrl().then((url) => {
     if (!url) return null;
-    const parsed = parseScmURL(url);
-    return parsed?.scmType && parsed.scmType !== "Unknown" ? url : null;
+    return parseScmURL(url)?.canonicalUrl ?? null;
   }).catch(() => null);
   const [{ branch, commitSha }, repositoryUrl] = await Promise.all([
     repoStatePromise,
@@ -17862,7 +17900,7 @@ import { spawn } from "child_process";
 import { readFileSync, writeFileSync as writeFileSync2 } from "fs";
 import * as os8 from "os";
 import path24 from "path";
-import { setTimeout as sleep3 } from "timers/promises";
+import { setTimeout as sleep4 } from "timers/promises";
 import Configstore3 from "configstore";
 
 // src/features/analysis/skill_quarantine/runQuarantineCheck.ts
@@ -18141,23 +18179,61 @@ var SCAN_PATHS = {
 // src/features/analysis/context_file_scanner.ts
 var MAX_CONTEXT_FILE_SIZE = 20 * 1024 * 1024;
 var SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+var FAILURE_BACKOFF_BASE_MS = 60 * 1e3;
+var FAILURE_BACKOFF_MAX_MS = 60 * 60 * 1e3;
 var sessionMtimes = /* @__PURE__ */ new Map();
 function markContextFilesUploaded(sessionId, files, skills) {
-  let entry = sessionMtimes.get(sessionId);
-  if (!entry) {
-    entry = { files: /* @__PURE__ */ new Map(), skills: /* @__PURE__ */ new Map(), lastUpdatedAt: Date.now() };
-    sessionMtimes.set(sessionId, entry);
-  }
+  const entry = getOrCreateSessionEntry(sessionId);
   for (const f of files) {
     entry.files.set(f.path, f.mtimeMs);
+    entry.failures.delete(f.path);
   }
   if (skills) {
     for (const sg of skills) {
       entry.skills.set(sg.sessionKey, sg.maxMtimeMs);
+      entry.failures.delete(sg.sessionKey);
     }
   }
   entry.lastUpdatedAt = Date.now();
 }
+function markContextUploadFailed(sessionId, files, skills) {
+  const entry = getOrCreateSessionEntry(sessionId);
+  const now = Date.now();
+  const recordFailure = (key) => {
+    const attempts = (entry.failures.get(key)?.attempts ?? 0) + 1;
+    const delay3 = Math.min(
+      FAILURE_BACKOFF_BASE_MS * 2 ** (attempts - 1),
+      FAILURE_BACKOFF_MAX_MS
+    );
+    entry.failures.set(key, { attempts, nextRetryAt: now + delay3 });
+  };
+  for (const f of files) {
+    recordFailure(f.path);
+  }
+  if (skills) {
+    for (const sg of skills) {
+      recordFailure(sg.sessionKey);
+    }
+  }
+  entry.lastUpdatedAt = now;
+}
+function getOrCreateSessionEntry(sessionId) {
+  let entry = sessionMtimes.get(sessionId);
+  if (!entry) {
+    entry = {
+      files: /* @__PURE__ */ new Map(),
+      skills: /* @__PURE__ */ new Map(),
+      failures: /* @__PURE__ */ new Map(),
+      lastUpdatedAt: Date.now()
+    };
+    sessionMtimes.set(sessionId, entry);
+  }
+  return entry;
+}
+function isInUploadBackoff(entry, key, now) {
+  const failure = entry.failures.get(key);
+  return failure !== void 0 && failure.nextRetryAt > now;
+}
 var COPILOT_CUSTOM_LOCATION_SETTINGS = [
   {
     key: "chat.agentSkillsLocations",
@@ -18517,6 +18593,9 @@ async function scanContextFiles(workspaceRoot, platform2, sessionId) {
           if (prevMtime !== void 0 && fileStat.mtimeMs <= prevMtime) {
             continue;
           }
+          if (sessionEntry && isInUploadBackoff(sessionEntry, filePath, now)) {
+            continue;
+          }
           allFiles.push(fileEntry);
         }
       } catch {
@@ -18532,6 +18611,9 @@ async function scanContextFiles(workspaceRoot, platform2, sessionId) {
         if (prevMtime !== void 0 && group.maxMtimeMs <= prevMtime) {
           continue;
         }
+        if (isInUploadBackoff(sessionEntry, group.sessionKey, now)) {
+          continue;
+        }
       }
       allSkillGroups.push(group);
     }
@@ -19120,6 +19202,7 @@ var lastRunAt = /* @__PURE__ */ new Map();
 var lastDirsMtimeMs = /* @__PURE__ */ new Map();
 var seenSkillMd5s = /* @__PURE__ */ new Set();
 var killSwitchLogged = false;
+var optInDisabledLogged = false;
 async function runQuarantineCheckIfNeeded(opts) {
   const { sessionId, cwd, gqlClient, log: log2 } = opts;
   if (process.env[KILL_SWITCH_ENV] === "1") {
@@ -19146,14 +19229,14 @@ async function runQuarantineCheckIfNeeded(opts) {
     return;
   }
   lastDirsMtimeMs.set(sessionId, dirsMtime);
-  log2.info(
+  log2.debug(
     { sessionId, metric: Metric.CHECK_TRIGGERED, hasNewSkills },
     "skill_quarantine: check start"
   );
   const t0 = Date.now();
   try {
     await reconcileAndSweep(log2);
-    log2.info(
+    log2.debug(
       { sessionId, count: installed.length, metric: Metric.SKILLS_CHECKED },
       "skill_quarantine: skills enumerated"
     );
@@ -19173,10 +19256,13 @@ async function runQuarantineCheckIfNeeded(opts) {
       log2
     );
     if (!quarantineEnabled) {
-      log2.info(
-        { sessionId, metric: Metric.CHECK_DISABLED_ORG },
-        "skill_quarantine: opt-in not enabled for any org of caller; skipping enforcement"
-      );
+      if (!optInDisabledLogged) {
+        log2.info(
+          { sessionId, metric: Metric.CHECK_DISABLED_ORG },
+          "skill_quarantine: opt-in not enabled for any org of caller; skipping enforcement"
+        );
+        optInDisabledLogged = true;
+      }
       return;
     }
     for (const skill of installed) {
@@ -19201,7 +19287,7 @@ async function runQuarantineCheckIfNeeded(opts) {
       }
     }
   } finally {
-    log2.info(
+    log2.debug(
       {
         sessionId,
         duration_ms: Date.now() - t0,
@@ -19313,9 +19399,27 @@ import path21 from "path";
 import { promisify } from "util";
 
 // src/features/analysis/context_file_uploader.ts
+import { setTimeout as sleep3 } from "timers/promises";
 import pLimit7 from "p-limit";
 init_client_generates();
 var UPLOAD_CONCURRENCY = 5;
+var UPLOAD_MAX_ATTEMPTS = 2;
+var UPLOAD_RETRY_BASE_MS = 250;
+async function uploadWithRetry(args) {
+  for (let attempt = 1; attempt <= UPLOAD_MAX_ATTEMPTS; attempt++) {
+    try {
+      await uploadFile(args);
+      return;
+    } catch (err) {
+      const isLastAttempt = attempt === UPLOAD_MAX_ATTEMPTS;
+      if (isLastAttempt || !isTransientUploadError(err)) {
+        throw err;
+      }
+      const backoff = UPLOAD_RETRY_BASE_MS * 2 ** (attempt - 1) * (1 + Math.random());
+      await sleep3(backoff);
+    }
+  }
+}
 async function uploadContextRecords(opts) {
   const {
     processedFiles,
@@ -19336,6 +19440,8 @@ async function uploadContextRecords(opts) {
   const records = [];
   const uploadedFiles = [];
   const uploadedSkillGroups = [];
+  const failedFiles = [];
+  const failedSkillGroups = [];
   const limit = pLimit7(UPLOAD_CONCURRENCY);
   const extraFields = {
     ...repositoryUrl !== void 0 && { repositoryUrl },
@@ -19348,13 +19454,14 @@ async function uploadContextRecords(opts) {
       (pf) => limit(async () => {
         const s3Key = `${keyPrefix}ctx-${pf.md5}.bin`;
         try {
-          await uploadFile({
+          await uploadWithRetry({
             file: Buffer.from(pf.sanitizedContent, "utf-8"),
             url,
             uploadKey: s3Key,
             uploadFields
           });
         } catch (err) {
+          failedFiles.push(pf.entry);
           onFileError?.(pf.entry.name, err);
           return;
         }
@@ -19382,13 +19489,14 @@ async function uploadContextRecords(opts) {
       (ps) => limit(async () => {
         const s3Key = `${keyPrefix}skill-${ps.md5}.zip`;
         try {
-          await uploadFile({
+          await uploadWithRetry({
             file: ps.zipBuffer,
             url,
             uploadKey: s3Key,
             uploadFields
           });
         } catch (err) {
+          failedSkillGroups.push(ps.group);
           onSkillError?.(ps.group.name, err);
           return;
         }
@@ -19414,7 +19522,13 @@ async function uploadContextRecords(opts) {
     )
   ];
   await Promise.allSettled(tasks);
-  return { records, uploadedFiles, uploadedSkillGroups };
+  return {
+    records,
+    uploadedFiles,
+    uploadedSkillGroups,
+    failedFiles,
+    failedSkillGroups
+  };
 }
 async function runContextFileUploadPipeline(opts) {
   const {
@@ -19440,7 +19554,13 @@ async function runContextFileUploadPipeline(opts) {
     return null;
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const { records, uploadedFiles, uploadedSkillGroups } = await uploadContextRecords({
+  const {
+    records,
+    uploadedFiles,
+    uploadedSkillGroups,
+    failedFiles,
+    failedSkillGroups
+  } = await uploadContextRecords({
     processedFiles,
     processedSkills,
     keyPrefix,
@@ -19456,6 +19576,9 @@ async function runContextFileUploadPipeline(opts) {
     onFileError,
     onSkillError
   });
+  if (failedFiles.length > 0 || failedSkillGroups.length > 0) {
+    markContextUploadFailed(sessionId, failedFiles, failedSkillGroups);
+  }
   if (records.length === 0) {
     return { fileCount: 0, skillCount: 0 };
   }
@@ -19807,7 +19930,7 @@ function createLogger(config2) {
 
 // src/features/claude_code/hook_logger.ts
 var DD_RUM_TOKEN = true ? "pubf59c0182545bfb4c299175119f1abf9b" : "";
-var CLI_VERSION = true ? "1.4.26" : "unknown";
+var CLI_VERSION = true ? "1.4.28" : "unknown";
 var NAMESPACE = "mobbdev-claude-code-hook-logs";
 var claudeCodeVersion;
 function buildDdTags() {
@@ -19986,7 +20109,7 @@ async function readNewTranscriptEntries(transcriptPath, sessionId, sessionStore,
       const stat5 = await fh.stat();
       fileSize = stat5.size;
       if (cursor.byteOffset >= stat5.size) {
-        hookLog.info({ data: { sessionId } }, "No new data in transcript file");
+        hookLog.debug({ data: { sessionId } }, "No new data in transcript file");
         return {
           entries: [],
           endByteOffset: fileSize,
@@ -20223,12 +20346,12 @@ async function processTranscript(input, sessionStore, log2, maxEntries = DAEMON_
   );
   const cursorKey = getCursorKey(resolvedTranscriptPath);
   if (rawEntries.length === 0) {
-    log2.info("No new entries to upload");
+    log2.debug("No new entries to upload");
     return { entriesUploaded: 0, entriesSkipped: 0, errors: 0 };
   }
   const { filtered: entries, filteredOut } = filterEntries(rawEntries);
   if (filteredOut > 0) {
-    log2.info(
+    log2.debug(
       { data: { filteredOut, remaining: entries.length } },
       "Filtered out noise entries"
     );
@@ -20911,7 +21034,7 @@ async function startDaemon() {
       },
       "daemon poll cycle"
     );
-    await sleep3(DAEMON_POLL_INTERVAL_MS);
+    await sleep4(DAEMON_POLL_INTERVAL_MS);
   }
 }
 async function acquirePidFile() {
@@ -28770,7 +28893,7 @@ var _FetchAvailableFixesService = class _FetchAvailableFixesService {
         interactiveFixes: fixReport.interactiveFixes ?? [],
         repositoryPath
       });
-      this.currentOffset = effectiveOffset + (fixReport.fixes?.length || 0);
+      this.currentOffset = effectiveOffset + (fixReport.fixes?.length || 0) + (fixReport.interactiveFixes?.length || 0);
       return prompt;
     } catch (error) {
       logError("Failed to check for available fixes", {
@@ -29128,7 +29251,7 @@ var _ScanAndFixVulnerabilitiesService = class _ScanAndFixVulnerabilitiesService
         interactiveFixes: fixes.interactiveFixes,
         repositoryPath
       });
-      this.currentOffset = effectiveOffset + (fixes.fixes?.length || 0);
+      this.currentOffset = effectiveOffset + (fixes.fixes?.length || 0) + (fixes.interactiveFixes?.length || 0);
       return prompt;
     } catch (error) {
       const message = error.message;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.4.26",
+  "version": "1.4.28",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",