mobbdev 1.4.46 → 1.4.47

package/dist/args/commands/upload_ai_blame.mjs

@@ -901,7 +901,7 @@ var init_client_generates = __esm({
 }
     `;
     DigestVulnerabilityReportDocument = `
-    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String) {
+    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String, $isFixEnabled: Boolean) {
   digestVulnerabilityReport(
     fixReportId: $fixReportId
     vulnerabilityReportFileName: $vulnerabilityReportFileName
@@ -911,6 +911,7 @@ var init_client_generates = __esm({
     reference: $reference
     sha: $sha
     baselineCommit: $baselineCommit
+    isFixEnabled: $isFixEnabled
   ) {
     __typename
     ... on VulnerabilityReport {
@@ -1460,6 +1461,7 @@ var init_analysis = __esm({
       analysisUrl: z3.string(),
       createdOn: z3.string(),
       state: z3.enum(Fix_Report_State_Enum),
+      isFixEnabled: z3.boolean().nullish(),
       repo: z3.object({
         name: z3.string().nullable(),
         originalUrl: z3.string(),
@@ -1835,6 +1837,8 @@ var init_types = __esm({
         createdOn: z7.string(),
         expirationOn: z7.string().nullable(),
         state: z7.enum(Fix_Report_State_Enum),
+        // NOT NULL column with a default, so always present on the wire.
+        isFixEnabled: z7.boolean(),
         failReason: z7.string().nullable(),
         candidateToRerun: z7.boolean(),
         fixes: z7.array(
@@ -5191,7 +5195,8 @@ var GQLClient = class {
     reference,
     sha,
     shouldScan,
-    baselineCommit
+    baselineCommit,
+    scanOnly
   }) {
     const res = await this._clientSdk.DigestVulnerabilityReport({
       fixReportId,
@@ -5201,7 +5206,9 @@ var GQLClient = class {
       repoUrl,
       reference,
       sha,
-      baselineCommit
+      baselineCommit,
+      // CLI exposes the inverse `--scan-only` flag; the wire field is isFixEnabled.
+      isFixEnabled: scanOnly === void 0 ? void 0 : !scanOnly
     });
     if (res.digestVulnerabilityReport.__typename !== "VulnerabilityReport") {
       throw new Error("Digesting vulnerability report failed");

package/dist/index.mjs

@@ -901,7 +901,7 @@ var init_client_generates = __esm({
 }
     `;
     DigestVulnerabilityReportDocument = `
-    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String) {
+    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String, $isFixEnabled: Boolean) {
   digestVulnerabilityReport(
     fixReportId: $fixReportId
     vulnerabilityReportFileName: $vulnerabilityReportFileName
@@ -911,6 +911,7 @@ var init_client_generates = __esm({
     reference: $reference
     sha: $sha
     baselineCommit: $baselineCommit
+    isFixEnabled: $isFixEnabled
   ) {
     __typename
     ... on VulnerabilityReport {
@@ -1562,6 +1563,7 @@ var init_analysis = __esm({
       analysisUrl: z4.string(),
       createdOn: z4.string(),
       state: z4.enum(Fix_Report_State_Enum),
+      isFixEnabled: z4.boolean().nullish(),
       repo: z4.object({
         name: z4.string().nullable(),
         originalUrl: z4.string(),
@@ -1880,6 +1882,8 @@ var init_types = __esm({
         createdOn: z7.string(),
         expirationOn: z7.string().nullable(),
         state: z7.enum(Fix_Report_State_Enum),
+        // NOT NULL column with a default, so always present on the wire.
+        isFixEnabled: z7.boolean(),
         failReason: z7.string().nullable(),
         candidateToRerun: z7.boolean(),
         fixes: z7.array(
@@ -11220,6 +11224,13 @@ var baselineCommitOption = {
   ),
   type: "string"
 };
+var scanOnlyOption = {
+  describe: chalk2.bold(
+    "Scan only: run the Mobb scan and report findings without generating fixes. The report can be fixed later (re-run without this flag, or use the Fix button in the app). Ignores fix-related flags (--auto-pr, --commit-directly, --create-one-pr)."
+  ),
+  type: "boolean",
+  default: false
+};
 var pollingOption = {
   describe: chalk2.bold(
     "Use HTTP polling instead of WebSocket for status updates. Useful for proxy environments or firewalls that block WebSocket connections. Polling interval: 5 seconds, timeout: 30 minutes."
@@ -11924,7 +11935,8 @@ var GQLClient = class {
     reference,
     sha,
     shouldScan,
-    baselineCommit
+    baselineCommit,
+    scanOnly
   }) {
     const res = await this._clientSdk.DigestVulnerabilityReport({
       fixReportId,
@@ -11934,7 +11946,9 @@ var GQLClient = class {
       repoUrl,
       reference,
       sha,
-      baselineCommit
+      baselineCommit,
+      // CLI exposes the inverse `--scan-only` flag; the wire field is isFixEnabled.
+      isFixEnabled: scanOnly === void 0 ? void 0 : !scanOnly
     });
     if (res.digestVulnerabilityReport.__typename !== "VulnerabilityReport") {
       throw new Error("Digesting vulnerability report failed");
@@ -15053,7 +15067,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
     commitDirectly,
     pullRequest,
     polling,
-    baselineCommit
+    baselineCommit,
+    scanOnly
   } = params;
   debug22("start %s %s", dirname, repo);
   const { createSpinner: createSpinner5 } = Spinner2({ ci });
@@ -15173,7 +15188,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
     shouldScan,
     polling,
     // Only meaningful when opengrep is going to run (no user-supplied report).
-    baselineCommit: shouldScan ? baselineCommit : void 0
+    baselineCommit: shouldScan ? baselineCommit : void 0,
+    scanOnly
   });
   uploadReportSpinner.success({ text: "\u{1F4C1} Report uploaded successfully" });
   const mobbSpinner = createSpinner5("\u{1F575}\uFE0F\u200D\u2642\uFE0F Initiating Mobb analysis").start();
@@ -15199,9 +15215,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
     throw new Error("\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed");
   }
   mobbSpinner.success({
-    text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
+    text: scanOnly ? "\u{1F50D} Scanning (scan-only, no fixes)..." : "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
   });
-  if (autoPr) {
+  if (autoPr && !scanOnly) {
     await handleAutoPr({
       gqlClient,
       analysisId: reportUploadInfo.fixReportId,
@@ -15213,7 +15229,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
     });
   }
   await askToOpenAnalysis();
-  if (command === "review") {
+  if (command === "review" && !scanOnly) {
     await waitForAnaysisAndReviewPr({
       repo,
       githubActionToken,
@@ -15320,7 +15336,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
         // shouldScan is false here (user provided a report); baseline filter
         // only applies to the opengrep code path. Drop it to keep the contract
         // honest with the CLI help text.
-        baselineCommit: void 0
+        baselineCommit: void 0,
+        scanOnly
       });
       const res = await _zipAndUploadRepo({
         srcPath,
@@ -15345,7 +15362,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
         ci,
         shouldScan: shouldScan2,
         polling,
-        baselineCommit
+        baselineCommit,
+        scanOnly
       });
     }
     const mobbSpinner2 = createSpinner5("\u{1F575}\uFE0F\u200D\u2642\uFE0F Initiating Mobb analysis").start();
@@ -15366,7 +15384,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
         },
         polling
       });
-      if (command === "review") {
+      if (command === "review" && !scanOnly) {
         await waitForAnaysisAndReviewPr({
           repo,
           githubActionToken,
@@ -15381,9 +15399,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
       throw e;
     }
     mobbSpinner2.success({
-      text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
+      text: scanOnly ? "\u{1F50D} Scanning (scan-only, no fixes)..." : "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
     });
-    if (autoPr) {
+    if (autoPr && !scanOnly) {
       await handleAutoPr({
         gqlClient,
         analysisId: reportUploadInfo.fixReportId,
@@ -15441,7 +15459,8 @@ async function _digestReport({
   reference,
   shouldScan,
   polling,
-  baselineCommit
+  baselineCommit,
+  scanOnly
 }) {
   const digestSpinner = createSpinner4(
     progressMassages.processingVulnerabilityReport
@@ -15456,7 +15475,8 @@ async function _digestReport({
         sha,
         reference,
         shouldScan,
-        baselineCommit
+        baselineCommit,
+        scanOnly
       }
     );
     const callbackStates = [
@@ -15707,7 +15727,8 @@ async function analyze({
   commitDirectly,
   pullRequest,
   polling,
-  baselineCommit
+  baselineCommit,
+  scanOnly
 }, { skipPrompts = false } = {}) {
   !ci && await showWelcomeMessage(skipPrompts);
   await runAnalysis(
@@ -15727,7 +15748,8 @@ async function analyze({
       pullRequest,
       createOnePr,
       polling,
-      baselineCommit
+      baselineCommit,
+      scanOnly
     },
     { skipPrompts }
   );
@@ -15937,7 +15959,10 @@ function analyzeBuilder(yargs2) {
     describe: chalk10.bold("Number of the pull request"),
     type: "number",
     demandOption: false
-  }).option("polling", pollingOption).option("baseline-commit", baselineCommitOption).example(
+  }).option("polling", pollingOption).option("baseline-commit", baselineCommitOption).option("scan-only", scanOnlyOption).example(
+    "npx mobbdev@latest analyze -r https://github.com/org/repo --scan-only",
+    "scan only \u2014 report findings without generating fixes"
+  ).example(
     "npx mobbdev@latest analyze -r https://github.com/WebGoat/WebGoat -f <your_vulnerability_report_path>",
     "analyze an existing repository"
   ).example(
@@ -18257,7 +18282,7 @@ function createLogger(config2) {
 
 // src/features/claude_code/hook_logger.ts
 var DD_RUM_TOKEN = true ? "pubf59c0182545bfb4c299175119f1abf9b" : "";
-var CLI_VERSION = true ? "1.4.46" : "unknown";
+var CLI_VERSION = true ? "1.4.47" : "unknown";
 var NAMESPACE = "mobbdev-claude-code-hook-logs";
 var claudeCodeVersion;
 function buildDdTags() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.4.46",
+  "version": "1.4.47",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",