mobbdev 1.4.46 → 1.4.48

package/dist/args/commands/upload_ai_blame.mjs

@@ -150,7 +150,7 @@ function getSdk(client, withWrapper = defaultWrapper) {
     }
   };
 }
-var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
+var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Scan_Source_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
 var init_client_generates = __esm({
   "src/features/analysis/scm/generates/client_generates.ts"() {
     "use strict";
@@ -250,6 +250,25 @@ var init_client_generates = __esm({
       Project_Role_Type_Enum2["Writer"] = "writer";
       return Project_Role_Type_Enum2;
     })(Project_Role_Type_Enum || {});
+    Scan_Source_Enum = /* @__PURE__ */ ((Scan_Source_Enum2) => {
+      Scan_Source_Enum2["Aspm"] = "ASPM";
+      Scan_Source_Enum2["AutoFixer"] = "AUTO_FIXER";
+      Scan_Source_Enum2["CiAzure"] = "CI_AZURE";
+      Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO";
+      Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI";
+      Scan_Source_Enum2["CiGithub"] = "CI_GITHUB";
+      Scan_Source_Enum2["CiGitlab"] = "CI_GITLAB";
+      Scan_Source_Enum2["CiJenkins"] = "CI_JENKINS";
+      Scan_Source_Enum2["CiUnknown"] = "CI_UNKNOWN";
+      Scan_Source_Enum2["Cli"] = "CLI";
+      Scan_Source_Enum2["Mcp"] = "MCP";
+      Scan_Source_Enum2["WebUiCheckmarxIntegration"] = "WEB_UI_CHECKMARX_INTEGRATION";
+      Scan_Source_Enum2["WebUiFixOwnCode"] = "WEB_UI_FIX_OWN_CODE";
+      Scan_Source_Enum2["WebUiOnboarding"] = "WEB_UI_ONBOARDING";
+      Scan_Source_Enum2["WebUiRerunAnalysis"] = "WEB_UI_RERUN_ANALYSIS";
+      Scan_Source_Enum2["WebUiTryNow"] = "WEB_UI_TRY_NOW";
+      return Scan_Source_Enum2;
+    })(Scan_Source_Enum || {});
     Vulnerability_Report_Issue_Category_Enum = /* @__PURE__ */ ((Vulnerability_Report_Issue_Category_Enum2) => {
       Vulnerability_Report_Issue_Category_Enum2["FalsePositive"] = "FalsePositive";
       Vulnerability_Report_Issue_Category_Enum2["Filtered"] = "Filtered";
@@ -481,6 +500,7 @@ var init_client_generates = __esm({
       organization {
         id
         enableV2Fixes
+        isFixEnabled
         projects(where: {name: {_eq: $projectName}}) {
           name
           id
@@ -500,6 +520,7 @@ var init_client_generates = __esm({
       organization {
         id
         enableV2Fixes
+        isFixEnabled
       }
     }
   }
@@ -901,7 +922,7 @@ var init_client_generates = __esm({
 }
     `;
     DigestVulnerabilityReportDocument = `
-    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String) {
+    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String, $isFixEnabled: Boolean) {
   digestVulnerabilityReport(
     fixReportId: $fixReportId
     vulnerabilityReportFileName: $vulnerabilityReportFileName
@@ -911,6 +932,7 @@ var init_client_generates = __esm({
     reference: $reference
     sha: $sha
     baselineCommit: $baselineCommit
+    isFixEnabled: $isFixEnabled
   ) {
     __typename
     ... on VulnerabilityReport {
@@ -1460,6 +1482,7 @@ var init_analysis = __esm({
       analysisUrl: z3.string(),
       createdOn: z3.string(),
       state: z3.enum(Fix_Report_State_Enum),
+      isFixEnabled: z3.boolean().nullish(),
       repo: z3.object({
         name: z3.string().nullable(),
         originalUrl: z3.string(),
@@ -1835,6 +1858,8 @@ var init_types = __esm({
         createdOn: z7.string(),
         expirationOn: z7.string().nullable(),
         state: z7.enum(Fix_Report_State_Enum),
+        // NOT NULL column with a default, so always present on the wire.
+        isFixEnabled: z7.boolean(),
         failReason: z7.string().nullable(),
         candidateToRerun: z7.boolean(),
         fixes: z7.array(
@@ -1891,6 +1916,8 @@ var init_types = __esm({
           reportSummaryUrl: z7.url().nullish(),
           computedVendor: z7.enum(Vulnerability_Report_Vendor_Enum).nullable(),
           vendor: z7.enum(Vulnerability_Report_Vendor_Enum).nullable(),
+          // Lets the waiting screen distinguish a first scan from a rescan.
+          scanSource: z7.enum(Scan_Source_Enum).nullable(),
           issuesWithKnownLanguage: z7.number().nullable(),
           scanDate: z7.string().nullable(),
           vendorReportId: z7.guid().nullable(),
@@ -5103,7 +5130,10 @@ var GQLClient = class {
     return {
       organizationId: organization.id,
       projectId,
-      enableV2Fixes: organization.enableV2Fixes === true
+      enableV2Fixes: organization.enableV2Fixes === true,
+      // NULL means "unset" and keeps the fix-enabled behaviour; only an
+      // explicit false puts the org in SAST-only mode.
+      isFixEnabled: organization.isFixEnabled !== false
     };
   }
   async getEncryptedApiToken(variables) {
@@ -5191,7 +5221,8 @@ var GQLClient = class {
     reference,
     sha,
     shouldScan,
-    baselineCommit
+    baselineCommit,
+    scanOnly
   }) {
     const res = await this._clientSdk.DigestVulnerabilityReport({
       fixReportId,
@@ -5201,7 +5232,9 @@ var GQLClient = class {
       repoUrl,
       reference,
       sha,
-      baselineCommit
+      baselineCommit,
+      // CLI exposes the inverse `--scan-only` flag; the wire field is isFixEnabled.
+      isFixEnabled: scanOnly === void 0 ? void 0 : !scanOnly
     });
     if (res.digestVulnerabilityReport.__typename !== "VulnerabilityReport") {
       throw new Error("Digesting vulnerability report failed");

package/dist/index.mjs

@@ -150,7 +150,7 @@ function getSdk(client, withWrapper = defaultWrapper) {
     }
   };
 }
-var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
+var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Scan_Source_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
 var init_client_generates = __esm({
   "src/features/analysis/scm/generates/client_generates.ts"() {
     "use strict";
@@ -250,6 +250,25 @@ var init_client_generates = __esm({
       Project_Role_Type_Enum2["Writer"] = "writer";
       return Project_Role_Type_Enum2;
     })(Project_Role_Type_Enum || {});
+    Scan_Source_Enum = /* @__PURE__ */ ((Scan_Source_Enum2) => {
+      Scan_Source_Enum2["Aspm"] = "ASPM";
+      Scan_Source_Enum2["AutoFixer"] = "AUTO_FIXER";
+      Scan_Source_Enum2["CiAzure"] = "CI_AZURE";
+      Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO";
+      Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI";
+      Scan_Source_Enum2["CiGithub"] = "CI_GITHUB";
+      Scan_Source_Enum2["CiGitlab"] = "CI_GITLAB";
+      Scan_Source_Enum2["CiJenkins"] = "CI_JENKINS";
+      Scan_Source_Enum2["CiUnknown"] = "CI_UNKNOWN";
+      Scan_Source_Enum2["Cli"] = "CLI";
+      Scan_Source_Enum2["Mcp"] = "MCP";
+      Scan_Source_Enum2["WebUiCheckmarxIntegration"] = "WEB_UI_CHECKMARX_INTEGRATION";
+      Scan_Source_Enum2["WebUiFixOwnCode"] = "WEB_UI_FIX_OWN_CODE";
+      Scan_Source_Enum2["WebUiOnboarding"] = "WEB_UI_ONBOARDING";
+      Scan_Source_Enum2["WebUiRerunAnalysis"] = "WEB_UI_RERUN_ANALYSIS";
+      Scan_Source_Enum2["WebUiTryNow"] = "WEB_UI_TRY_NOW";
+      return Scan_Source_Enum2;
+    })(Scan_Source_Enum || {});
     Vulnerability_Report_Issue_Category_Enum = /* @__PURE__ */ ((Vulnerability_Report_Issue_Category_Enum2) => {
       Vulnerability_Report_Issue_Category_Enum2["FalsePositive"] = "FalsePositive";
       Vulnerability_Report_Issue_Category_Enum2["Filtered"] = "Filtered";
@@ -481,6 +500,7 @@ var init_client_generates = __esm({
       organization {
         id
         enableV2Fixes
+        isFixEnabled
         projects(where: {name: {_eq: $projectName}}) {
           name
           id
@@ -500,6 +520,7 @@ var init_client_generates = __esm({
       organization {
         id
         enableV2Fixes
+        isFixEnabled
       }
     }
   }
@@ -901,7 +922,7 @@ var init_client_generates = __esm({
 }
     `;
     DigestVulnerabilityReportDocument = `
-    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String) {
+    mutation DigestVulnerabilityReport($vulnerabilityReportFileName: String, $fixReportId: String!, $projectId: String!, $scanSource: String!, $repoUrl: String, $reference: String, $sha: String, $baselineCommit: String, $isFixEnabled: Boolean) {
   digestVulnerabilityReport(
     fixReportId: $fixReportId
     vulnerabilityReportFileName: $vulnerabilityReportFileName
@@ -911,6 +932,7 @@ var init_client_generates = __esm({
     reference: $reference
     sha: $sha
     baselineCommit: $baselineCommit
+    isFixEnabled: $isFixEnabled
   ) {
     __typename
     ... on VulnerabilityReport {
@@ -1562,6 +1584,7 @@ var init_analysis = __esm({
       analysisUrl: z4.string(),
       createdOn: z4.string(),
       state: z4.enum(Fix_Report_State_Enum),
+      isFixEnabled: z4.boolean().nullish(),
       repo: z4.object({
         name: z4.string().nullable(),
         originalUrl: z4.string(),
@@ -1880,6 +1903,8 @@ var init_types = __esm({
         createdOn: z7.string(),
         expirationOn: z7.string().nullable(),
         state: z7.enum(Fix_Report_State_Enum),
+        // NOT NULL column with a default, so always present on the wire.
+        isFixEnabled: z7.boolean(),
         failReason: z7.string().nullable(),
         candidateToRerun: z7.boolean(),
         fixes: z7.array(
@@ -1936,6 +1961,8 @@ var init_types = __esm({
           reportSummaryUrl: z7.url().nullish(),
           computedVendor: z7.enum(Vulnerability_Report_Vendor_Enum).nullable(),
           vendor: z7.enum(Vulnerability_Report_Vendor_Enum).nullable(),
+          // Lets the waiting screen distinguish a first scan from a rescan.
+          scanSource: z7.enum(Scan_Source_Enum).nullable(),
           issuesWithKnownLanguage: z7.number().nullable(),
           scanDate: z7.string().nullable(),
           vendorReportId: z7.guid().nullable(),
@@ -11220,6 +11247,13 @@ var baselineCommitOption = {
   ),
   type: "string"
 };
+var scanOnlyOption = {
+  describe: chalk2.bold(
+    "Scan only: run the Mobb scan and report findings without generating fixes. The report can be fixed later (re-run without this flag, or use the Fix button in the app). Ignores fix-related flags (--auto-pr, --commit-directly, --create-one-pr)."
+  ),
+  type: "boolean",
+  default: false
+};
 var pollingOption = {
   describe: chalk2.bold(
     "Use HTTP polling instead of WebSocket for status updates. Useful for proxy environments or firewalls that block WebSocket connections. Polling interval: 5 seconds, timeout: 30 minutes."
@@ -11836,7 +11870,10 @@ var GQLClient = class {
     return {
       organizationId: organization.id,
       projectId,
-      enableV2Fixes: organization.enableV2Fixes === true
+      enableV2Fixes: organization.enableV2Fixes === true,
+      // NULL means "unset" and keeps the fix-enabled behaviour; only an
+      // explicit false puts the org in SAST-only mode.
+      isFixEnabled: organization.isFixEnabled !== false
     };
   }
   async getEncryptedApiToken(variables) {
@@ -11924,7 +11961,8 @@ var GQLClient = class {
     reference,
     sha,
     shouldScan,
-    baselineCommit
+    baselineCommit,
+    scanOnly
   }) {
     const res = await this._clientSdk.DigestVulnerabilityReport({
       fixReportId,
@@ -11934,7 +11972,9 @@ var GQLClient = class {
       repoUrl,
       reference,
       sha,
-      baselineCommit
+      baselineCommit,
+      // CLI exposes the inverse `--scan-only` flag; the wire field is isFixEnabled.
+      isFixEnabled: scanOnly === void 0 ? void 0 : !scanOnly
     });
     if (res.digestVulnerabilityReport.__typename !== "VulnerabilityReport") {
       throw new Error("Digesting vulnerability report failed");
@@ -15053,7 +15093,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
     commitDirectly,
     pullRequest,
     polling,
-    baselineCommit
+    baselineCommit,
+    scanOnly: requestedScanOnly
   } = params;
   debug22("start %s %s", dirname, repo);
   const { createSpinner: createSpinner5 } = Spinner2({ ci });
@@ -15069,11 +15110,20 @@ async function _scan(params, { skipPrompts = false } = {}) {
   const {
     projectId,
     organizationId,
-    enableV2Fixes: orgEnableV2Fixes
+    enableV2Fixes: orgEnableV2Fixes,
+    isFixEnabled: orgIsFixEnabled
   } = await gqlClient.getLastOrgAndNamedProject({
     projectName: mobbProjectName,
     userDefinedOrganizationId: userOrganizationId
   });
+  const scanOnly = requestedScanOnly || !orgIsFixEnabled;
+  if (scanOnly && !requestedScanOnly) {
+    console.log(
+      chalk7.yellow(
+        "\u2139\uFE0F  Your organization is on Mobb Scan (scan-only): issues will be found and reported, but no fixes are generated. Contact support to enable Mobb Fixer."
+      )
+    );
+  }
   const {
     uploadS3BucketInfo: { repoUploadInfo, reportUploadInfo }
   } = await gqlClient.uploadS3BucketInfo();
@@ -15173,7 +15223,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
     shouldScan,
     polling,
     // Only meaningful when opengrep is going to run (no user-supplied report).
-    baselineCommit: shouldScan ? baselineCommit : void 0
+    baselineCommit: shouldScan ? baselineCommit : void 0,
+    scanOnly
   });
   uploadReportSpinner.success({ text: "\u{1F4C1} Report uploaded successfully" });
   const mobbSpinner = createSpinner5("\u{1F575}\uFE0F\u200D\u2642\uFE0F Initiating Mobb analysis").start();
@@ -15199,9 +15250,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
     throw new Error("\u{1F575}\uFE0F\u200D\u2642\uFE0F Mobb analysis failed");
   }
   mobbSpinner.success({
-    text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
+    text: scanOnly ? "\u{1F50D} Scanning (scan-only, no fixes)..." : "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
   });
-  if (autoPr) {
+  if (autoPr && !scanOnly) {
     await handleAutoPr({
       gqlClient,
       analysisId: reportUploadInfo.fixReportId,
@@ -15213,7 +15264,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
     });
   }
   await askToOpenAnalysis();
-  if (command === "review") {
+  if (command === "review" && !scanOnly) {
     await waitForAnaysisAndReviewPr({
       repo,
       githubActionToken,
@@ -15320,7 +15371,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
         // shouldScan is false here (user provided a report); baseline filter
         // only applies to the opengrep code path. Drop it to keep the contract
         // honest with the CLI help text.
-        baselineCommit: void 0
+        baselineCommit: void 0,
+        scanOnly
       });
       const res = await _zipAndUploadRepo({
         srcPath,
@@ -15345,7 +15397,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
         ci,
         shouldScan: shouldScan2,
         polling,
-        baselineCommit
+        baselineCommit,
+        scanOnly
       });
     }
     const mobbSpinner2 = createSpinner5("\u{1F575}\uFE0F\u200D\u2642\uFE0F Initiating Mobb analysis").start();
@@ -15366,7 +15419,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
         },
         polling
       });
-      if (command === "review") {
+      if (command === "review" && !scanOnly) {
         await waitForAnaysisAndReviewPr({
           repo,
           githubActionToken,
@@ -15381,9 +15434,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
       throw e;
     }
     mobbSpinner2.success({
-      text: "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
+      text: scanOnly ? "\u{1F50D} Scanning (scan-only, no fixes)..." : "\u{1F575}\uFE0F\u200D\u2642\uFE0F Generating fixes..."
     });
-    if (autoPr) {
+    if (autoPr && !scanOnly) {
       await handleAutoPr({
         gqlClient,
         analysisId: reportUploadInfo.fixReportId,
@@ -15441,7 +15494,8 @@ async function _digestReport({
   reference,
   shouldScan,
   polling,
-  baselineCommit
+  baselineCommit,
+  scanOnly
 }) {
   const digestSpinner = createSpinner4(
     progressMassages.processingVulnerabilityReport
@@ -15456,7 +15510,8 @@ async function _digestReport({
         sha,
         reference,
         shouldScan,
-        baselineCommit
+        baselineCommit,
+        scanOnly
       }
     );
     const callbackStates = [
@@ -15707,7 +15762,8 @@ async function analyze({
   commitDirectly,
   pullRequest,
   polling,
-  baselineCommit
+  baselineCommit,
+  scanOnly
 }, { skipPrompts = false } = {}) {
   !ci && await showWelcomeMessage(skipPrompts);
   await runAnalysis(
@@ -15727,7 +15783,8 @@ async function analyze({
       pullRequest,
       createOnePr,
       polling,
-      baselineCommit
+      baselineCommit,
+      scanOnly
     },
     { skipPrompts }
   );
@@ -15937,7 +15994,10 @@ function analyzeBuilder(yargs2) {
     describe: chalk10.bold("Number of the pull request"),
     type: "number",
     demandOption: false
-  }).option("polling", pollingOption).option("baseline-commit", baselineCommitOption).example(
+  }).option("polling", pollingOption).option("baseline-commit", baselineCommitOption).option("scan-only", scanOnlyOption).example(
+    "npx mobbdev@latest analyze -r https://github.com/org/repo --scan-only",
+    "scan only \u2014 report findings without generating fixes"
+  ).example(
     "npx mobbdev@latest analyze -r https://github.com/WebGoat/WebGoat -f <your_vulnerability_report_path>",
     "analyze an existing repository"
   ).example(
@@ -18257,7 +18317,7 @@ function createLogger(config2) {
 
 // src/features/claude_code/hook_logger.ts
 var DD_RUM_TOKEN = true ? "pubf59c0182545bfb4c299175119f1abf9b" : "";
-var CLI_VERSION = true ? "1.4.46" : "unknown";
+var CLI_VERSION = true ? "1.4.48" : "unknown";
 var NAMESPACE = "mobbdev-claude-code-hook-logs";
 var claudeCodeVersion;
 function buildDdTags() {
@@ -20031,6 +20091,7 @@ var partitionInteractiveFixes = (fixes) => {
 };
 
 // src/mcp/services/McpGQLClient.ts
+var MVS_SCAN_ONLY_ERROR = "Mobb Vibe Shield is not available for your organization: it is on Mobb Scan (scan-only), which reports issues but does not generate fixes. Contact support to enable Mobb Fixer.";
 var McpGQLClient = class extends GQLClient {
   constructor(args) {
     super({
@@ -20210,12 +20271,16 @@ var McpGQLClient = class extends GQLClient {
         throw new Error("User email not found");
       }
       const orgRes = await this._clientSdk.getLastOrg({ email: userEmail });
-      const organizationId = orgRes.user?.[0]?.userOrganizationsAndUserOrganizationRoles?.[0]?.organization?.id;
+      const organization = orgRes.user?.[0]?.userOrganizationsAndUserOrganizationRoles?.[0]?.organization;
+      const organizationId = organization?.id;
       if (!organizationId) {
         throw new Error(
           `The user with email:${userEmail} is not associated with any organization`
         );
       }
+      if (organization.isFixEnabled === false) {
+        throw new Error(MVS_SCAN_ONLY_ERROR);
+      }
       const mvsRes = await this._clientSdk.getMvsProject({ organizationId });
       const projectId = mvsRes.getMvsProject?.projectId;
       if (!projectId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.4.46",
+  "version": "1.4.48",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.mjs",