mobbdev 1.4.67 → 1.5.0

package/dist/index.mjs

@@ -34,6 +34,18 @@ function getSdk(client, withWrapper = defaultWrapper) {
     getAnalysisSubscription(variables, requestHeaders, signal) {
       return withWrapper((wrappedRequestHeaders) => client.request({ document: GetAnalysisSubscriptionDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "getAnalysisSubscription", "subscription", variables);
     },
+    GetOrganizationId(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: GetOrganizationIdDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "GetOrganizationId", "query", variables);
+    },
+    UpdateOrgScanPolicy(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: UpdateOrgScanPolicyDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "UpdateOrgScanPolicy", "mutation", variables);
+    },
+    GetReportFindingRuleIds(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: GetReportFindingRuleIdsDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "GetReportFindingRuleIds", "query", variables);
+    },
+    getGateVerdict(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: GetGateVerdictDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "getGateVerdict", "query", variables);
+    },
     getAnalysis(variables, requestHeaders, signal) {
       return withWrapper((wrappedRequestHeaders) => client.request({ document: GetAnalysisDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "getAnalysis", "query", variables);
     },
@@ -150,7 +162,7 @@ function getSdk(client, withWrapper = defaultWrapper) {
     }
   };
 }
-var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Scan_Source_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
+var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Scan_Source_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetOrganizationIdDocument, UpdateOrgScanPolicyDocument, GetReportFindingRuleIdsDocument, GetGateVerdictDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
 var init_client_generates = __esm({
   "src/features/analysis/scm/generates/client_generates.ts"() {
     "use strict";
@@ -558,6 +570,66 @@ var init_client_generates = __esm({
     state
     failReason
   }
+}
+    `;
+    GetOrganizationIdDocument = `
+    query GetOrganizationId {
+  organization {
+    id
+  }
+}
+    `;
+    UpdateOrgScanPolicyDocument = `
+    mutation UpdateOrgScanPolicy($organizationId: String!, $policyJson: String) {
+  updateOrganizationScanPolicy(
+    organizationId: $organizationId
+    policyJson: $policyJson
+  ) {
+    __typename
+    ... on ScanPolicyUpdateSuccess {
+      storedPolicyJson
+      warnings
+    }
+    ... on ScanPolicyValidationError {
+      error
+    }
+  }
+}
+    `;
+    GetReportFindingRuleIdsDocument = `
+    query GetReportFindingRuleIds($fixReportId: uuid!) {
+  fixReport_by_pk(id: $fixReportId) {
+    vulnerabilityReport {
+      vulnerabilityReportIssues {
+        extraData(path: "rule_id")
+      }
+    }
+  }
+}
+    `;
+    GetGateVerdictDocument = `
+    query getGateVerdict($fixReportId: String!) {
+  getGateVerdict(fixReportId: $fixReportId) {
+    __typename
+    ... on GateVerdictSuccess {
+      blocking
+      blockingCount
+      totalIssues
+      criticalCount
+      highCount
+      mediumCount
+      lowCount
+      unclassifiedCount
+      description
+      degraded
+    }
+    ... on GateVerdictNotReady {
+      state
+    }
+    ... on GateVerdictError {
+      error
+    }
+  }
 }
     `;
     GetAnalysisDocument = `
@@ -643,35 +715,20 @@ var init_client_generates = __esm({
 }
     `;
     GetVulByNodesMetadataDocument = `
-    query getVulByNodesMetadata($filters: [vulnerability_report_issue_code_node_bool_exp!], $vulnerabilityReportId: uuid!) {
-  vulnerabilityReportIssueCodeNodes: vulnerability_report_issue_code_node(
-    order_by: {index: desc}
-    where: {_or: $filters, vulnerabilityReportIssue: {fixId: {_is_null: false}, vulnerabilityReportId: {_eq: $vulnerabilityReportId}}}
-  ) {
-    vulnerabilityReportIssueId
-    path
-    startLine
-    vulnerabilityReportIssue {
-      safeIssueType
-      fixId
-      category
-      vulnerabilityReportIssueTags {
-        tag: vulnerability_report_issue_tag_value
-      }
-    }
-  }
-  fixablePrVuls: vulnerability_report_issue_aggregate(
-    where: {fixId: {_is_null: false}, vulnerabilityReportId: {_eq: $vulnerabilityReportId}, codeNodes: {_or: $filters}}
+    query getVulByNodesMetadata($pathFilters: [vulnerability_report_issue_bool_exp!], $vulnerabilityReportId: uuid!) {
+  vulnerabilityReportIssues: vulnerability_report_issue(
+    where: {vulnerabilityReportId: {_eq: $vulnerabilityReportId}, _or: $pathFilters}
   ) {
-    aggregate {
-      count
+    id
+    safeIssueType
+    fixId
+    fpId
+    category
+    vulnerabilityReportIssueTags {
+      tag: vulnerability_report_issue_tag_value
     }
-  }
-  nonFixablePrVuls: vulnerability_report_issue_aggregate(
-    where: {fixId: {_is_null: true}, vulnerabilityReportId: {_eq: $vulnerabilityReportId}, codeNodes: {_or: $filters}}
-  ) {
-    aggregate {
-      count
+    codeNodesJson {
+      nodes
     }
   }
   totalScanVulnerabilities: vulnerability_report_issue_aggregate(
@@ -681,26 +738,6 @@ var init_client_generates = __esm({
       count
     }
   }
-  irrelevantVulnerabilityReportIssue: vulnerability_report(
-    where: {id: {_eq: $vulnerabilityReportId}}
-  ) {
-    vulnerabilityReportIssues(
-      where: {fixId: {_is_null: true}, category: {_in: [Irrelevant, FalsePositive, Filtered]}, _not: {vulnerabilityReportIssueTags: {vulnerability_report_issue_tag_value: {_eq: SUPPRESSED}}}}
-    ) {
-      id
-      safeIssueType
-      fixId
-      category
-      vulnerabilityReportIssueTags {
-        tag: vulnerability_report_issue_tag_value
-      }
-      codeNodes(order_by: {index: desc}, where: {_or: $filters}, limit: 1) {
-        path
-        startLine
-      }
-      fpId
-    }
-  }
 }
     `;
     GetFalsePositiveDocument = `
@@ -1862,7 +1899,7 @@ var init_validations = __esm({
 
 // src/features/analysis/scm/shared/src/types/types.ts
 import { z as z7 } from "zod";
-var OrganizationScreenQueryParamsZ, ProjectPageQueryParamsZ, AnalysisPageQueryParamsZ, FixPageQueryParamsZ, IssuePageQueryParamsZ, CliLoginPageQueryParamsZ, AnalysisReportDigestedZ, IssueSharedStateZ2, ReportQueryResultZ, ReportFixesQueryFixZ, BaseVulnerabilityReportIssueZ, VulnerabilityReportIssueZ, VulnerabilityReportIssueWithCodeFilePathZ, GetReportIssuesQueryZ, FixReportByProjectZ, FixScreenQueryResultZ, FixPageQueryZ, GetReportFixesQueryZ, GetFixReportStatsQueryZ, ProjectVulnerabilityReport, GetProjectsQueryZ, ProjectPageQueryResultZ, GetProjectMembersDataZ, RepoArgsZ, scmCloudUrl, ScmType, ConvertToSarifInputFileFormat;
+var OrganizationScreenQueryParamsZ, ProjectPageQueryParamsZ, AnalysisPageQueryParamsZ, FixPageQueryParamsZ, IssuePageQueryParamsZ, CliLoginPageQueryParamsZ, AnalysisReportDigestedZ, IssueSharedStateZ2, ReportQueryResultZ, ReportFixesQueryFixZ, BaseVulnerabilityReportIssueZ, VulnerabilityReportIssueWithCodeFilePathZ, GetReportIssuesQueryZ, FixReportByProjectZ, FixScreenQueryResultZ, FixPageQueryZ, GetReportFixesQueryZ, GetFixReportStatsQueryZ, ProjectVulnerabilityReport, GetProjectsQueryZ, ProjectPageQueryResultZ, GetProjectMembersDataZ, RepoArgsZ, scmCloudUrl, ScmType, ConvertToSarifInputFileFormat;
 var init_types = __esm({
   "src/features/analysis/scm/shared/src/types/types.ts"() {
     "use strict";
@@ -2124,11 +2161,6 @@ var init_types = __esm({
       ),
       sharedState: VulnerabilityReportIssueSharedStateZ
     });
-    VulnerabilityReportIssueZ = BaseVulnerabilityReportIssueZ.extend(
-      z7.object({
-        codeNodes: z7.array(z7.object({ path: z7.string() }))
-      }).shape
-    );
     VulnerabilityReportIssueWithCodeFilePathZ = BaseVulnerabilityReportIssueZ.extend(
       z7.object({
         codeFilePath: z7.string().nullable()
@@ -4263,7 +4295,7 @@ import Debug23 from "debug";
 import { hideBin } from "yargs/helpers";
 
 // src/args/yargs.ts
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import yargs from "yargs/yargs";
 
 // src/args/commands/convert_to_sarif.ts
@@ -10795,6 +10827,17 @@ function createGitWithLogging(dirName, logger3 = defaultLogger) {
 // src/utils/index.ts
 var sleep = (ms = 2e3) => new Promise((r) => setTimeout(r, ms));
 var CliError = class extends Error {
+  constructor(message, options = {}) {
+    super(message);
+    /**
+     * The process exit code index.ts maps this error to. Defaults to 1 (plain
+     * operational error) so every existing throw keeps its behavior; 2 means the
+     * gate policy blocked the run (MOBB-3810), so CI can tell "your code is
+     * gated" from "the tool broke".
+     */
+    __publicField(this, "exitCode");
+    this.exitCode = options.exitCode ?? 1;
+  }
 };
 
 // src/commands/fpr_stream_parser.ts
@@ -11441,6 +11484,13 @@ var scanOnlyOption = {
   type: "boolean",
   default: false
 };
+var gateOption = {
+  describe: chalk2.bold(
+    "Enforce the organization's Scan & Gate Policy: after the scan, the backend decides whether any finding blocks, and the CLI exits 2 when it does (0 = pass, 1 = operational error; a scan that fails to finish exits 1, not 2). Mobb scans only \u2014 cannot be combined with --scan-file. In PR pipelines pair it with --baseline-commit so only findings new in the PR can block."
+  ),
+  type: "boolean",
+  default: false
+};
 var pollingOption = {
   describe: chalk2.bold(
     "Use HTTP polling instead of WebSocket for status updates. Useful for proxy environments or firewalls that block WebSocket connections. Polling interval: 5 seconds, timeout: 30 minutes."
@@ -11494,10 +11544,10 @@ var ScanContext = {
 
 // src/args/commands/analyze.ts
 import fs13 from "fs";
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 
 // src/commands/index.ts
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 import chalkAnimation from "chalk-animation";
 
 // src/features/analysis/index.ts
@@ -11506,7 +11556,7 @@ import fsPromises3 from "fs/promises";
 import path11 from "path";
 import { env as env2 } from "process";
 import { pipeline as pipeline2 } from "stream/promises";
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 import Debug22 from "debug";
 import extract from "extract-zip";
 import { createSpinner as createSpinner4 } from "nanospinner";
@@ -11828,65 +11878,104 @@ init_client_generates();
 // src/features/analysis/graphql/types.ts
 init_client_generates();
 import { z as z22 } from "zod";
-var VulnerabilityReportIssueCodeNodeZ = z22.object({
-  vulnerabilityReportIssueId: z22.string(),
+function codeNodesJsonPathFilter(path38) {
+  return { codeNodesJson: { nodes: { _contains: [{ path: path38 }] } } };
+}
+var VulByNodesMetadataCodeNodeZ = z22.object({
+  index: z22.number().int(),
   path: z22.string(),
-  startLine: z22.number(),
-  vulnerabilityReportIssue: z22.object({
-    fixId: z22.string(),
-    category: z22.enum(Vulnerability_Report_Issue_Category_Enum),
-    safeIssueType: z22.string(),
-    vulnerabilityReportIssueTags: z22.array(
-      z22.object({
-        tag: z22.enum(Vulnerability_Report_Issue_Tag_Enum)
-      })
-    )
-  })
-});
-var VulnerabilityReportIssueNoFixCodeNodeZ = z22.object({
-  vulnerabilityReportIssues: z22.array(
+  startLine: z22.number().int(),
+  endLine: z22.number().int()
+}).loose();
+var VulnerabilityReportIssueWithNodesZ = z22.object({
+  id: z22.string(),
+  fixId: z22.string().nullable(),
+  category: z22.enum(Vulnerability_Report_Issue_Category_Enum),
+  safeIssueType: z22.string(),
+  fpId: z22.guid().nullable(),
+  vulnerabilityReportIssueTags: z22.array(
     z22.object({
-      id: z22.string(),
-      fixId: z22.string().nullable(),
-      category: z22.enum(Vulnerability_Report_Issue_Category_Enum),
-      safeIssueType: z22.string(),
-      fpId: z22.guid().nullable(),
-      codeNodes: z22.array(
-        z22.object({
-          path: z22.string(),
-          startLine: z22.number()
-        })
-      ),
-      vulnerabilityReportIssueTags: z22.array(
-        z22.object({
-          tag: z22.enum(Vulnerability_Report_Issue_Tag_Enum)
-        })
-      )
+      tag: z22.enum(Vulnerability_Report_Issue_Tag_Enum)
     })
-  )
+  ),
+  codeNodesJson: z22.object({ nodes: z22.unknown() }).nullable()
 });
 var GetVulByNodesMetadataZ = z22.object({
-  vulnerabilityReportIssueCodeNodes: z22.array(VulnerabilityReportIssueCodeNodeZ),
-  nonFixablePrVuls: z22.object({
-    aggregate: z22.object({
-      count: z22.number()
-    })
-  }),
-  fixablePrVuls: z22.object({
-    aggregate: z22.object({
-      count: z22.number()
-    })
-  }),
+  vulnerabilityReportIssues: z22.array(VulnerabilityReportIssueWithNodesZ),
   totalScanVulnerabilities: z22.object({
     aggregate: z22.object({
       count: z22.number()
     })
-  }),
-  irrelevantVulnerabilityReportIssue: z22.array(
-    VulnerabilityReportIssueNoFixCodeNodeZ
-  )
+  })
 });
 
+// src/features/analysis/graphql/matchVulByNodesMetadata.ts
+var IRRELEVANT_CATEGORIES = /* @__PURE__ */ new Set([
+  "Irrelevant",
+  "FalsePositive",
+  "Filtered"
+]);
+var SUPPRESSED_TAG = "SUPPRESSED";
+function nodeMatchesHunks(node, hunks) {
+  return hunks.some(
+    (hunk) => hunk.path === node.path && hunk.ranges.some(
+      ({ startLine, endLine }) => node.startLine >= startLine && node.startLine <= endLine || node.endLine >= startLine && node.endLine <= endLine
+    )
+  );
+}
+function matchingNodes(issue, hunks) {
+  const rawNodes = issue.codeNodesJson?.nodes;
+  if (!Array.isArray(rawNodes)) {
+    return [];
+  }
+  return rawNodes.map((rawNode) => VulByNodesMetadataCodeNodeZ.safeParse(rawNode)).filter((parsed) => parsed.success).map((parsed) => parsed.data).filter((node) => nodeMatchesHunks(node, hunks)).sort((a, b) => b.index - a.index);
+}
+function matchVulByNodesMetadata(issues, hunks) {
+  const vulnerabilityReportIssueCodeNodes = [];
+  let fixablePrVuls = 0;
+  let nonFixablePrVuls = 0;
+  const irrelevantVulnerabilityReportIssues = [];
+  for (const issue of issues) {
+    const nodes = matchingNodes(issue, hunks);
+    const bestNode = nodes[0];
+    if (issue.fixId !== null && bestNode) {
+      fixablePrVuls += 1;
+      vulnerabilityReportIssueCodeNodes.push({
+        vulnerabilityReportIssueId: issue.id,
+        path: bestNode.path,
+        startLine: bestNode.startLine,
+        vulnerabilityReportIssue: {
+          fixId: issue.fixId,
+          category: issue.category,
+          safeIssueType: issue.safeIssueType,
+          vulnerabilityReportIssueTags: issue.vulnerabilityReportIssueTags
+        }
+      });
+    } else if (issue.fixId === null && bestNode) {
+      nonFixablePrVuls += 1;
+    }
+    if (issue.fixId === null && IRRELEVANT_CATEGORIES.has(issue.category) && !issue.vulnerabilityReportIssueTags.some(
+      (issueTag) => issueTag.tag === SUPPRESSED_TAG
+    )) {
+      irrelevantVulnerabilityReportIssues.push({
+        id: issue.id,
+        safeIssueType: issue.safeIssueType,
+        fixId: issue.fixId,
+        category: issue.category,
+        vulnerabilityReportIssueTags: issue.vulnerabilityReportIssueTags,
+        codeNodes: bestNode ? [{ path: bestNode.path, startLine: bestNode.startLine }] : [],
+        fpId: issue.fpId
+      });
+    }
+  }
+  return {
+    vulnerabilityReportIssueCodeNodes,
+    fixablePrVuls,
+    nonFixablePrVuls,
+    irrelevantVulnerabilityReportIssues
+  };
+}
+
 // src/features/analysis/graphql/gql.ts
 var debug7 = Debug6("mobbdev:gql");
 function isAuthError(error) {
@@ -12094,44 +12183,28 @@ var GQLClient = class {
     hunks,
     vulnerabilityReportId
   }) {
-    const filters = hunks.map((hunk) => {
-      const filter = {
-        path: { _eq: hunk.path },
-        _or: hunk.ranges.flatMap(({ endLine, startLine }) => {
-          return [
-            { startLine: { _gte: startLine, _lte: endLine } },
-            { endLine: { _gte: startLine, _lte: endLine } }
-          ];
-        })
-      };
-      return filter;
-    });
+    const pathFilters = hunks.map((hunk) => codeNodesJsonPathFilter(hunk.path));
     const getVulByNodesMetadataRes = await this._clientSdk.getVulByNodesMetadata({
-      filters: { _or: filters },
+      pathFilters,
       vulnerabilityReportId
     });
     const parsedGetVulByNodesMetadataRes = GetVulByNodesMetadataZ.parse(
       getVulByNodesMetadataRes
     );
-    const uniqueVulByNodesMetadata = parsedGetVulByNodesMetadataRes.vulnerabilityReportIssueCodeNodes.reduce((acc, vulnerabilityReportIssueCodeNode) => {
-      if (acc[vulnerabilityReportIssueCodeNode.vulnerabilityReportIssueId]) {
-        return acc;
-      }
-      return {
-        ...acc,
-        [vulnerabilityReportIssueCodeNode.vulnerabilityReportIssueId]: vulnerabilityReportIssueCodeNode
-      };
-    }, {});
-    const nonFixablePrVuls = parsedGetVulByNodesMetadataRes.nonFixablePrVuls.aggregate.count;
-    const fixablePrVuls = parsedGetVulByNodesMetadataRes.fixablePrVuls.aggregate.count;
+    const {
+      vulnerabilityReportIssueCodeNodes,
+      fixablePrVuls,
+      nonFixablePrVuls,
+      irrelevantVulnerabilityReportIssues
+    } = matchVulByNodesMetadata(
+      parsedGetVulByNodesMetadataRes.vulnerabilityReportIssues,
+      hunks
+    );
     const totalScanVulnerabilities = parsedGetVulByNodesMetadataRes.totalScanVulnerabilities.aggregate.count;
     const vulnerabilitiesOutsidePr = totalScanVulnerabilities - nonFixablePrVuls - fixablePrVuls;
     const totalPrVulnerabilities = nonFixablePrVuls + fixablePrVuls;
-    const irrelevantVulnerabilityReportIssues = parsedGetVulByNodesMetadataRes.irrelevantVulnerabilityReportIssue?.[0]?.vulnerabilityReportIssues ?? [];
     return {
-      vulnerabilityReportIssueCodeNodes: Object.values(
-        uniqueVulByNodesMetadata
-      ),
+      vulnerabilityReportIssueCodeNodes,
       nonFixablePrVuls,
       fixablePrVuls,
       totalScanVulnerabilities,
@@ -12339,6 +12412,14 @@ var GQLClient = class {
     }
     return res.analysis;
   }
+  /**
+   * The gate verdict for a Mobb-scan report (MOBB-3810). The backend is the
+   * only decider; the caller maps the answer onto an exit code.
+   */
+  async getGateVerdict(fixReportId) {
+    const res = await this._clientSdk.getGateVerdict({ fixReportId });
+    return res.getGateVerdict;
+  }
   async autoPrAnalysis({
     analysisId,
     commitDirectly,
@@ -14571,6 +14652,36 @@ async function handleAutoPr(params) {
   }
 }
 
+// src/features/analysis/gate_verdict.ts
+import chalk5 from "chalk";
+async function enforceGateVerdict({
+  gqlClient,
+  fixReportId
+}) {
+  const verdict = await gqlClient.getGateVerdict(fixReportId);
+  if (verdict.__typename === "GateVerdictError") {
+    throw new CliError(`\u{1F6A7} Gate verdict unavailable: ${verdict.error}`);
+  }
+  if (verdict.__typename === "GateVerdictNotReady") {
+    throw new CliError(
+      `\u{1F6A7} Gate verdict not ready \u2014 report state is ${verdict.state}`
+    );
+  }
+  if (verdict.degraded) {
+    console.log(
+      chalk5.yellow(
+        "\u26A0\uFE0F  The gate policy could not be read; the fail-closed default was applied."
+      )
+    );
+  }
+  if (verdict.blocking) {
+    throw new CliError(chalk5.red(`\u{1F6A7} Gate: ${verdict.description}`), {
+      exitCode: 2
+    });
+  }
+  console.log(chalk5.green(`\u{1F6A7} Gate: ${verdict.description}`));
+}
+
 // src/features/analysis/git.ts
 init_GitService();
 import Debug17 from "debug";
@@ -14799,7 +14910,7 @@ async function snykArticlePrompt() {
 
 // src/features/analysis/scanners/checkmarx.ts
 import { createRequire } from "module";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 import Debug20 from "debug";
 import { existsSync } from "fs";
 import { createSpinner as createSpinner2 } from "nanospinner";
@@ -14970,7 +15081,7 @@ async function throwCheckmarxConfigError() {
   await createSpinner2("\u{1F513} Checkmarx is not configued correctly").start().error();
   throw new CliError(
     `Checkmarx is not configued correctly
- you can configure it by using the ${chalk5.bold(
+ you can configure it by using the ${chalk6.bold(
       "cx configure"
     )} command`
   );
@@ -14978,8 +15089,8 @@ async function throwCheckmarxConfigError() {
 async function validateCheckamxCredentials() {
   console.log(`
         Here's a suggestion for checkmarx configuation: 
-          ${chalk5.bold("AST Base URI:")} https://ast.checkmarx.net
-          ${chalk5.bold("AST Base Auth URI (IAM):")} https://iam.checkmarx.net
+          ${chalk6.bold("AST Base URI:")} https://ast.checkmarx.net
+          ${chalk6.bold("AST Base Auth URI (IAM):")} https://iam.checkmarx.net
   `);
   await forkCheckmarx(CONFIGURE_COMMAND, { display: true });
   const { code: loginCode } = await forkCheckmarx(VALIDATE_COMMAND, {
@@ -15004,7 +15115,7 @@ import os4 from "os";
 import path10 from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
-import chalk6 from "chalk";
+import chalk7 from "chalk";
 import Debug21 from "debug";
 import { createSpinner as createSpinner3 } from "nanospinner";
 import open2 from "open";
@@ -15168,7 +15279,7 @@ async function getSnykReport(reportPath, repoRoot, { skipPrompts = false }) {
       await open2(SNYK_ARTICLE_URL);
     }
     console.log(
-      chalk6.bgBlue(
+      chalk7.bgBlue(
         "\nPlease enable Snyk Code in your Snyk account and try again."
       )
     );
@@ -15224,7 +15335,7 @@ async function downloadRepo({
   if (!response.ok) {
     debug22("SCM zipball request failed %s %s", response.body, response.status);
     repoSpinner.error({ text: "\u{1F4BE} Repo download failed" });
-    throw new Error(`Can't access ${chalk7.bold(repoUrl)}`);
+    throw new Error(`Can't access ${chalk8.bold(repoUrl)}`);
   }
   const fileWriterStream = fs11.createWriteStream(zipFilePath);
   if (!response.body) {
@@ -15391,7 +15502,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
     pullRequest,
     polling,
     baselineCommit,
-    scanOnly: requestedScanOnly
+    scanOnly: requestedScanOnly,
+    gate
   } = params;
   debug22("start %s %s", dirname, repo);
   const { createSpinner: createSpinner5 } = Spinner2({ ci });
@@ -15401,6 +15513,15 @@ async function _scan(params, { skipPrompts = false } = {}) {
     isSkipPrompts: skipPrompts
   });
   await gqlClient.loadIssueTypeCatalog();
+  const runGate = async (fixReportId) => {
+    await waitForAnalysisFinished({
+      gqlClient,
+      analysisId: fixReportId,
+      polling,
+      ci
+    });
+    await enforceGateVerdict({ gqlClient, fixReportId });
+  };
   if (!mobbProjectName) {
     throw new Error("mobbProjectName is required");
   }
@@ -15416,7 +15537,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
   const scanOnly = requestedScanOnly || !orgIsFixEnabled;
   if (scanOnly && !requestedScanOnly) {
     console.log(
-      chalk7.yellow(
+      chalk8.yellow(
         "\u2139\uFE0F  Your organization is on Mobb Scan (scan-only): issues will be found and reported, but no fixes are generated. Contact support to enable Mobb Fixer."
       )
     );
@@ -15571,6 +15692,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
       polling
     });
   }
+  if (gate) {
+    await runGate(reportUploadInfo.fixReportId);
+  }
   return reportUploadInfo.fixReportId;
   async function askToOpenAnalysis() {
     if (!repoUploadInfo || !reportUploadInfo) {
@@ -15582,11 +15706,11 @@ async function _scan(params, { skipPrompts = false } = {}) {
       fixReportId: reportUploadInfo.fixReportId
     });
     !ci && console.log("You can access the analysis at: \n");
-    console.log(chalk7.bold(reportUrl));
+    console.log(chalk8.bold(reportUrl));
     !skipPrompts && await mobbAnalysisPrompt();
     !ci && open3(reportUrl);
     !ci && console.log(
-      chalk7.bgBlue("\n\n  My work here is done for now, see you soon! \u{1F575}\uFE0F\u200D\u2642\uFE0F  ")
+      chalk8.bgBlue("\n\n  My work here is done for now, see you soon! \u{1F575}\uFE0F\u200D\u2642\uFE0F  ")
     );
   }
   async function handleScmIntegration(oldToken, scmAuthUrl2, repoUrl) {
@@ -15745,6 +15869,9 @@ async function _scan(params, { skipPrompts = false } = {}) {
       });
     }
     await askToOpenAnalysis();
+    if (gate) {
+      await runGate(reportUploadInfo.fixReportId);
+    }
     return reportUploadInfo.fixReportId;
   }
 }
@@ -15823,7 +15950,7 @@ async function _digestReport({
         "[_digestReport] Using POLLING mode for analysis state updates (--polling flag enabled)"
       );
       console.log(
-        chalk7.cyan(
+        chalk8.cyan(
           "\u{1F504} [Polling Mode] Using HTTP polling instead of WebSocket for status updates"
         )
       );
@@ -15838,7 +15965,7 @@ async function _digestReport({
         "[_digestReport] Using WEBSOCKET mode for analysis state updates (default)"
       );
       console.log(
-        chalk7.cyan(
+        chalk8.cyan(
           "\u{1F50C} [WebSocket Mode] Using WebSocket subscription for status updates"
         )
       );
@@ -15902,7 +16029,7 @@ async function waitForAnaysisAndReviewPr({
       "[waitForAnaysisAndReviewPr] Using POLLING mode for analysis state updates"
     );
     console.log(
-      chalk7.cyan(
+      chalk8.cyan(
         "\u{1F504} [Polling Mode] Waiting for analysis completion using HTTP polling"
       )
     );
@@ -15916,7 +16043,7 @@ async function waitForAnaysisAndReviewPr({
       "[waitForAnaysisAndReviewPr] Using WEBSOCKET mode for analysis state updates"
     );
     console.log(
-      chalk7.cyan(
+      chalk8.cyan(
         "\u{1F50C} [WebSocket Mode] Waiting for analysis completion using WebSocket"
       )
     );
@@ -15929,6 +16056,41 @@ async function waitForAnaysisAndReviewPr({
     });
   }
 }
+async function waitForAnalysisFinished({
+  gqlClient,
+  analysisId,
+  polling,
+  ci
+}) {
+  const { createSpinner: createSpinner5 } = Spinner2({ ci });
+  const gateSpinner = createSpinner5(
+    "\u{1F6A7} Waiting for the analysis to finish to evaluate the gate\u2026"
+  ).start();
+  const callback = () => void 0;
+  try {
+    if (polling) {
+      await gqlClient.pollForAnalysisState({
+        analysisId,
+        callback,
+        callbackStates: ["Finished" /* Finished */]
+      });
+    } else {
+      await gqlClient.subscribeToAnalysis({
+        subscribeToAnalysisParams: {
+          analysisId
+        },
+        callback,
+        callbackStates: ["Finished" /* Finished */]
+      });
+    }
+  } catch (e) {
+    gateSpinner.error({
+      text: e instanceof ReportDigestError ? "\u{1F6A7} Analysis failed \u2014 cannot evaluate the gate" : "\u{1F6A7} Analysis did not finish"
+    });
+    throw e;
+  }
+  gateSpinner.success({ text: "\u{1F6A7} Analysis finished, evaluating the gate" });
+}
 
 // src/commands/scan_skill_input.ts
 import fs12 from "fs";
@@ -16060,7 +16222,8 @@ async function analyze({
   pullRequest,
   polling,
   baselineCommit,
-  scanOnly
+  scanOnly,
+  gate
 }, { skipPrompts = false } = {}) {
   !ci && await showWelcomeMessage(skipPrompts);
   await runAnalysis(
@@ -16081,7 +16244,8 @@ async function analyze({
       createOnePr,
       polling,
       baselineCommit,
-      scanOnly
+      scanOnly,
+      gate
     },
     { skipPrompts }
   );
@@ -16156,14 +16320,14 @@ async function scanSkill(options) {
     inputApiKey: apiKey,
     isSkipPrompts: ci
   });
-  console.log(chalk8.dim(`Scanning skill: ${url}`));
+  console.log(chalk9.dim(`Scanning skill: ${url}`));
   console.log();
   const skillUrl = await resolveSkillScanInput(url);
   const result = await gqlClient.scanSkill({ skillUrl });
   const scan2 = result.scanSkill;
   const verdictColor = VERDICT_COLORS[scan2.verdict] ?? "white";
   console.log(
-    chalk8.bold(`Verdict: `) + chalk8[verdictColor](
+    chalk9.bold(`Verdict: `) + chalk9[verdictColor](
       scan2.verdict
     )
   );
@@ -16175,32 +16339,32 @@ async function scanSkill(options) {
   console.log(`Findings: ${scan2.findingsCount}`);
   console.log(`Duration: ${scan2.scanDurationMs}ms`);
   if (scan2.cached) {
-    console.log(chalk8.dim("(cached result)"));
+    console.log(chalk9.dim("(cached result)"));
   }
   console.log();
   if (scan2.findings.length > 0) {
-    console.log(chalk8.bold("Findings:"));
+    console.log(chalk9.bold("Findings:"));
     console.log();
     for (const f of scan2.findings) {
       const sevColor = SEVERITY_COLORS[f.severity] ?? "white";
       const location = [f.filePath, f.lineNumber].filter(Boolean).join(":");
       console.log(
-        `  ${chalk8[sevColor](f.severity)} [${f.layer}] ${f.category}${f.ruleId ? ` (${f.ruleId})` : ""}`
+        `  ${chalk9[sevColor](f.severity)} [${f.layer}] ${f.category}${f.ruleId ? ` (${f.ruleId})` : ""}`
       );
       if (location) {
-        console.log(`    ${chalk8.dim(location)}`);
+        console.log(`    ${chalk9.dim(location)}`);
       }
       console.log(`    ${f.explanation}`);
       if (f.evidence) {
         console.log(
-          `    ${String(chalk8.dim("Evidence: " + f.evidence.slice(0, 120))).replace(/\n|\r/g, "")}`
+          `    ${String(chalk9.dim("Evidence: " + f.evidence.slice(0, 120))).replace(/\n|\r/g, "")}`
         );
       }
       console.log();
     }
   }
   if (scan2.summary) {
-    console.log(chalk8.bold("Analysis:"));
+    console.log(chalk9.bold("Analysis:"));
     console.log(`  ${scan2.summary}`);
     console.log();
   }
@@ -16210,7 +16374,7 @@ async function scanSkill(options) {
 }
 
 // src/args/validation.ts
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 import path13 from "path";
 import { z as z28 } from "zod";
 function throwRepoUrlErrorMessage({
@@ -16220,11 +16384,11 @@ function throwRepoUrlErrorMessage({
 }) {
   const errorMessage3 = error.issues[error.issues.length - 1]?.message;
   const formattedErrorMessage = `
-Error: ${chalk9.bold(
+Error: ${chalk10.bold(
     repoUrl
   )} is ${errorMessage3}
 Example: 
-	mobbdev ${command} -r ${chalk9.bold(
+	mobbdev ${command} -r ${chalk10.bold(
     "https://github.com/WebGoat/WebGoat"
   )}`;
   throw new CliError(formattedErrorMessage);
@@ -16258,9 +16422,9 @@ function validateReportFileFormat(reportFile) {
   if (!supportExtensions.includes(path13.extname(reportFile))) {
     throw new CliError(
       `
-${chalk9.bold(
+${chalk10.bold(
         reportFile
-      )} is not a supported file extension. Supported extensions are: ${chalk9.bold(
+      )} is not a supported file extension. Supported extensions are: ${chalk10.bold(
         supportExtensions.join(", ")
       )}
 `
@@ -16273,27 +16437,30 @@ function analyzeBuilder(yargs2) {
   return yargs2.option("f", {
     alias: "scan-file",
     type: "string",
-    describe: chalk10.bold(
+    describe: chalk11.bold(
       "Select the vulnerability report to analyze (Checkmarx, Snyk, Fortify, CodeQL, Sonarqube, Semgrep, Datadog, Black Duck)"
     )
   }).option("repo", repoOption).option("p", {
     alias: "src-path",
-    describe: chalk10.bold(
+    describe: chalk11.bold(
       "Path to the repository folder with the source code; alternatively, you can specify the Fortify FPR file to extract source code out of it"
     ),
     type: "string"
   }).option("ref", refOption).option("ch", {
     alias: "commit-hash",
-    describe: chalk10.bold("Hash of the commit"),
+    describe: chalk11.bold("Hash of the commit"),
     type: "string"
   }).option("mobb-project-name", mobbProjectNameOption).option("y", yesOption).option("ci", ciOption).option("org", organizationIdOptions).option("api-key", apiKeyOption).option("commit-hash", commitHashOption).option("auto-pr", autoPrOption).option("create-one-pr", createOnePrOption).option("commit-directly", commitDirectlyOption).option("pull-request", {
     alias: ["pr", "pr-number", "pr-id"],
-    describe: chalk10.bold("Number of the pull request"),
+    describe: chalk11.bold("Number of the pull request"),
     type: "number",
     demandOption: false
-  }).option("polling", pollingOption).option("baseline-commit", baselineCommitOption).option("scan-only", scanOnlyOption).example(
+  }).option("polling", pollingOption).option("baseline-commit", baselineCommitOption).option("scan-only", scanOnlyOption).option("gate", gateOption).example(
     "npx mobbdev@latest analyze -r https://github.com/org/repo --scan-only",
     "scan only \u2014 report findings without generating fixes"
+  ).example(
+    "npx mobbdev@latest analyze -r https://github.com/org/repo --ci --api-key <key> --baseline-commit <sha> --gate",
+    "PR pipeline: scan the diff and fail the build (exit 2) when the Scan & Gate Policy blocks"
   ).example(
     "npx mobbdev@latest analyze -r https://github.com/WebGoat/WebGoat -f <your_vulnerability_report_path>",
     "analyze an existing repository"
@@ -16303,9 +16470,14 @@ function analyzeBuilder(yargs2) {
   ).help();
 }
 function validateAnalyzeOptions(argv) {
+  if (argv.gate && argv.f) {
+    throw new CliError(
+      "--gate enforces the policy on a Mobb scan and cannot be combined with --scan-file"
+    );
+  }
   if (argv.f && !fs13.existsSync(argv.f)) {
     throw new CliError(`
-Can't access ${chalk10.bold(argv.f)}`);
+Can't access ${chalk11.bold(argv.f)}`);
   }
   validateOrganizationId(argv.organizationId);
   if (!argv.srcPath && !argv.repo) {
@@ -16343,7 +16515,15 @@ Can't access ${chalk10.bold(argv.f)}`);
 }
 async function analyzeHandler(args) {
   validateAnalyzeOptions(args);
-  await analyze(args, { skipPrompts: args.yes });
+  try {
+    await analyze(args, { skipPrompts: args.yes });
+  } catch (err) {
+    if (err instanceof CliError && err.exitCode !== 1) {
+      console.error(err.message);
+      process.exit(err.exitCode);
+    }
+    throw err;
+  }
 }
 
 // src/args/commands/claude_code.ts
@@ -18614,7 +18794,7 @@ function createLogger(config2) {
 
 // src/features/claude_code/hook_logger.ts
 var DD_RUM_TOKEN = true ? "pubf59c0182545bfb4c299175119f1abf9b" : "";
-var CLI_VERSION = true ? "1.4.67" : "unknown";
+var CLI_VERSION = true ? "1.5.0" : "unknown";
 var NAMESPACE = "mobbdev-claude-code-hook-logs";
 var claudeCodeVersion;
 function buildDdTags() {
@@ -19281,7 +19461,7 @@ import fs15 from "fs";
 import fsPromises4 from "fs/promises";
 import os7 from "os";
 import path23 from "path";
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 
 // src/features/claude_code/daemon-check-shim.tmpl.js
 var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\nvar spawn = require('child_process').spawn\nvar path = require('path')\nvar os = require('os')\n\nvar pidFile = path.join(os.homedir(), '.mobbdev', 'daemon.pid')\nvar HEARTBEAT_STALE_MS = __HEARTBEAT_STALE_MS__\n\ntry {\n  var data = JSON.parse(fs.readFileSync(pidFile, 'utf8'))\n  if (Date.now() - data.heartbeat > HEARTBEAT_STALE_MS) throw new Error('stale')\n  process.kill(data.pid, 0) // throws ESRCH if the process is gone\n} catch (e) {\n  var localCli = process.env.MOBBDEV_LOCAL_CLI\n  var child = localCli\n    ? spawn('node', [localCli, 'claude-code-daemon'], { detached: true, stdio: 'ignore', windowsHide: true })\n    : spawn('npx', ['--yes', 'mobbdev@latest', 'claude-code-daemon'], { detached: true, stdio: 'ignore', shell: true, windowsHide: true })\n  child.unref()\n}\n";
@@ -19367,12 +19547,12 @@ async function autoUpgradeMatcherIfStale() {
   }
 }
 async function installMobbHooks(options = {}) {
-  console.log(chalk11.blue("Installing Mobb hooks in Claude Code settings..."));
+  console.log(chalk12.blue("Installing Mobb hooks in Claude Code settings..."));
   if (!await claudeSettingsExists()) {
-    console.log(chalk11.red("\u274C Claude Code settings file not found"));
-    console.log(chalk11.yellow(`Expected location: ${CLAUDE_SETTINGS_PATH}`));
-    console.log(chalk11.yellow("Is Claude Code installed on your system?"));
-    console.log(chalk11.yellow("Please install Claude Code and try again."));
+    console.log(chalk12.red("\u274C Claude Code settings file not found"));
+    console.log(chalk12.yellow(`Expected location: ${CLAUDE_SETTINGS_PATH}`));
+    console.log(chalk12.yellow("Is Claude Code installed on your system?"));
+    console.log(chalk12.yellow("Please install Claude Code and try again."));
     throw new Error(
       "Claude Code settings file not found. Is Claude Code installed?"
     );
@@ -19397,7 +19577,7 @@ async function installMobbHooks(options = {}) {
     if (envVars.length > 0) {
       envPrefix = envVars.join(" ");
       console.log(
-        chalk11.blue(
+        chalk12.blue(
           `Adding environment variables to hook command: ${envVars.join(", ")}`
         )
       );
@@ -19418,15 +19598,15 @@ async function installMobbHooks(options = {}) {
     (hook) => hook.hooks.some((h) => isMobbHookCommand(h.command))
   );
   if (existingHookIndex >= 0) {
-    console.log(chalk11.yellow("Mobb hook already exists, updating..."));
+    console.log(chalk12.yellow("Mobb hook already exists, updating..."));
     settings.hooks.PostToolUse[existingHookIndex] = mobbHookConfig;
   } else {
-    console.log(chalk11.green("Adding new Mobb hook..."));
+    console.log(chalk12.green("Adding new Mobb hook..."));
     settings.hooks.PostToolUse.push(mobbHookConfig);
   }
   await writeClaudeSettings(settings);
   console.log(
-    chalk11.green(
+    chalk12.green(
       `\u2705 Mobb hooks ${options.saveEnv ? "and environment variables " : ""}installed successfully in ${CLAUDE_SETTINGS_PATH}`
     )
   );
@@ -20395,6 +20575,13 @@ var partitionInteractiveFixes = (fixes) => {
 
 // src/mcp/services/McpGQLClient.ts
 var MVS_SCAN_ONLY_ERROR = "Mobb Vibe Shield is not available for your organization: it is on Mobb Scan (scan-only), which reports issues but does not generate fixes. Contact support to enable Mobb Fixer.";
+function issueTouchesFilesFilter(fileFilter) {
+  return {
+    _or: fileFilter.map((path38) => ({
+      codeNodesJson: { nodes: { _contains: [{ path: path38 }] } }
+    }))
+  };
+}
 var McpGQLClient = class extends GQLClient {
   constructor(args) {
     super({
@@ -20764,9 +20951,7 @@ var McpGQLClient = class extends GQLClient {
       }
       const filters = {};
       if (fileFilter && fileFilter.length > 0) {
-        filters["vulnerabilityReportIssues"] = {
-          codeNodes: { path: { _in: fileFilter } }
-        };
+        filters["vulnerabilityReportIssues"] = issueTouchesFilesFilter(fileFilter);
       }
       const escapedRepoUrl = repoUrl.replace(/[%_\\]/g, (c) => `\\${c}`);
       const resp = await this._clientSdk.GetLatestReportByRepoUrl({
@@ -20818,9 +21003,7 @@ var McpGQLClient = class extends GQLClient {
       filters["severityText"] = { _in: severity };
     }
     if (fileFilter && fileFilter.length > 0) {
-      filters["vulnerabilityReportIssues"] = {
-        codeNodes: { path: { _in: fileFilter } }
-      };
+      filters["vulnerabilityReportIssues"] = issueTouchesFilesFilter(fileFilter);
     }
     try {
       logDebug("[GraphQL] Calling GetReportFixes query", {
@@ -28482,32 +28665,32 @@ var mcpHandler = async (_args) => {
 
 // src/args/commands/review.ts
 import fs27 from "fs";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 function reviewBuilder(yargs2) {
   return yargs2.option("f", {
     alias: "scan-file",
     demandOption: true,
     type: "string",
-    describe: chalk12.bold(
+    describe: chalk13.bold(
       "Select the vulnerability report to analyze (Checkmarx, Snyk, Fortify, CodeQL, Sonarqube, Semgrep)"
     )
   }).option("repo", { ...repoOption, demandOption: true }).option("scanner", { ...scannerOptions, demandOption: true }).option("ref", { ...refOption, demandOption: true }).option("ch", {
     alias: "commit-hash",
-    describe: chalk12.bold("Hash of the commit"),
+    describe: chalk13.bold("Hash of the commit"),
     type: "string",
     demandOption: true
   }).option("mobb-project-name", mobbProjectNameOption).option("api-key", { ...apiKeyOption, demandOption: true }).option("commit-hash", { ...commitHashOption, demandOption: true }).option("github-token", {
-    describe: chalk12.bold("Github action token"),
+    describe: chalk13.bold("Github action token"),
     type: "string",
     demandOption: true
   }).option("pull-request", {
     alias: ["pr", "pr-number", "pr-id"],
-    describe: chalk12.bold("Number of the pull request"),
+    describe: chalk13.bold("Number of the pull request"),
     type: "number",
     demandOption: true
   }).option("p", {
     alias: "src-path",
-    describe: chalk12.bold(
+    describe: chalk13.bold(
       "Path to the repository folder with the source code"
     ),
     type: "string",
@@ -28520,7 +28703,7 @@ function reviewBuilder(yargs2) {
 function validateReviewOptions(argv) {
   if (!fs27.existsSync(argv.f)) {
     throw new CliError(`
-Can't access ${chalk12.bold(argv.f)}`);
+Can't access ${chalk13.bold(argv.f)}`);
   }
   validateRepoUrl(argv);
   validateReportFileFormat(argv.f);
@@ -28556,12 +28739,12 @@ async function scanHandler(args) {
 }
 
 // src/args/commands/scan_skill.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 function scanSkillBuilder(args) {
   return args.option("url", {
     demandOption: true,
     type: "string",
-    describe: chalk13.bold(
+    describe: chalk14.bold(
       "URL or local directory of the skill to scan (GitHub repo, ZIP archive, raw SKILL.md, or folder containing SKILL.md)"
     )
   }).option("api-key", apiKeyOption).option("ci", ciOption).example(
@@ -28984,7 +29167,7 @@ function processChatStepCodeAction(step) {
 import fsPromises5 from "fs/promises";
 import os19 from "os";
 import path37 from "path";
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 function getCodeiumHooksPath() {
   return path37.join(os19.homedir(), ".codeium", "hooks.json");
 }
@@ -29009,7 +29192,7 @@ async function writeCodeiumHooks(config2) {
 }
 async function installWindsurfHooks(options = {}) {
   const hooksPath = getCodeiumHooksPath();
-  console.log(chalk14.blue("Installing Mobb hooks in Windsurf IntelliJ..."));
+  console.log(chalk15.blue("Installing Mobb hooks in Windsurf IntelliJ..."));
   const config2 = await readCodeiumHooks();
   if (!config2.hooks) {
     config2.hooks = {};
@@ -29029,7 +29212,7 @@ async function installWindsurfHooks(options = {}) {
     if (envVars.length > 0) {
       command = `${envVars.join(" ")} ${command}`;
       console.log(
-        chalk14.blue(
+        chalk15.blue(
           `Adding environment variables to hook command: ${envVars.join(", ")}`
         )
       );
@@ -29043,15 +29226,15 @@ async function installWindsurfHooks(options = {}) {
     (hook) => hook.command?.includes("mobbdev@latest windsurf-intellij-process-hook")
   );
   if (existingHookIndex >= 0) {
-    console.log(chalk14.yellow("Mobb hook already exists, updating..."));
+    console.log(chalk15.yellow("Mobb hook already exists, updating..."));
     config2.hooks.post_write_code[existingHookIndex] = mobbHook;
   } else {
-    console.log(chalk14.green("Adding new Mobb hook..."));
+    console.log(chalk15.green("Adding new Mobb hook..."));
     config2.hooks.post_write_code.push(mobbHook);
   }
   await writeCodeiumHooks(config2);
   console.log(
-    chalk14.green(
+    chalk15.green(
       `\u2705 Mobb hooks ${options.saveEnv ? "and environment variables " : ""}installed successfully in ${hooksPath}`
     )
   );
@@ -29101,93 +29284,93 @@ var windsurfIntellijProcessHookHandler = async () => {
 var parseArgs = async (args) => {
   const yargsInstance = yargs(args);
   return yargsInstance.updateStrings({
-    "Commands:": chalk15.yellow.underline.bold("Commands:"),
-    "Options:": chalk15.yellow.underline.bold("Options:"),
-    "Examples:": chalk15.yellow.underline.bold("Examples:"),
-    "Show help": chalk15.bold("Show help")
+    "Commands:": chalk16.yellow.underline.bold("Commands:"),
+    "Options:": chalk16.yellow.underline.bold("Options:"),
+    "Examples:": chalk16.yellow.underline.bold("Examples:"),
+    "Show help": chalk16.bold("Show help")
   }).usage(
-    `${chalk15.bold(
+    `${chalk16.bold(
       "\n Bugsy - Trusted, Automatic Vulnerability Fixer \u{1F575}\uFE0F\u200D\u2642\uFE0F\n\n"
-    )} ${chalk15.yellow.underline.bold("Usage:")} 
-  $0 ${chalk15.green(
+    )} ${chalk16.yellow.underline.bold("Usage:")} 
+  $0 ${chalk16.green(
       "<command>"
-    )} ${chalk15.dim("[options]")}
+    )} ${chalk16.dim("[options]")}
             `
   ).version(false).command(
     mobbCliCommand.scan,
-    chalk15.bold(
+    chalk16.bold(
       "Scan your code for vulnerabilities, get automated fixes right away."
     ),
     scanBuilder,
     scanHandler
   ).command(
     mobbCliCommand.analyze,
-    chalk15.bold(
+    chalk16.bold(
       "Provide a code repository, get automated fixes right away. You can also provide a vulnerability report to analyze or have Mobb scan the code for you."
     ),
     analyzeBuilder,
     analyzeHandler
   ).command(
     mobbCliCommand.review,
-    chalk15.bold(
+    chalk16.bold(
       "Mobb will review your github pull requests and provide comments with fixes "
     ),
     reviewBuilder,
     reviewHandler
   ).command(
     mobbCliCommand.addScmToken,
-    chalk15.bold(
+    chalk16.bold(
       "Add your SCM (Github, Gitlab, Azure DevOps) token to Mobb to enable automated fixes."
     ),
     addScmTokenBuilder,
     addScmTokenHandler
   ).command(
     mobbCliCommand.scanSkill,
-    chalk15.bold("Scan an OpenClaw/ClawHub skill for security threats."),
+    chalk16.bold("Scan an OpenClaw/ClawHub skill for security threats."),
     scanSkillBuilder,
     scanSkillHandler
   ).command(
     mobbCliCommand.convertToSarif,
-    chalk15.bold("Convert an existing SAST report to SARIF format."),
+    chalk16.bold("Convert an existing SAST report to SARIF format."),
     convertToSarifBuilder,
     convertToSarifHandler
   ).command(
     mobbCliCommand.mcp,
-    chalk15.bold("Launch the MCP (Model Context Protocol) server."),
+    chalk16.bold("Launch the MCP (Model Context Protocol) server."),
     mcpBuilder,
     mcpHandler
   ).command(
     mobbCliCommand.uploadAiBlame,
-    chalk15.bold(
+    chalk16.bold(
       "Upload AI Blame inference artifacts (prompt + inference) and finalize them."
     ),
     uploadAiBlameBuilder,
     uploadAiBlameCommandHandler
   ).command(
     mobbCliCommand.claudeCodeInstallHook,
-    chalk15.bold("Install Claude Code hooks for data collection."),
+    chalk16.bold("Install Claude Code hooks for data collection."),
     claudeCodeInstallHookBuilder,
     claudeCodeInstallHookHandler
   ).command(
     mobbCliCommand.claudeCodeProcessHook,
-    chalk15.bold("Process Claude Code hook data (legacy \u2014 spawns daemon)."),
+    chalk16.bold("Process Claude Code hook data (legacy \u2014 spawns daemon)."),
     claudeCodeProcessHookBuilder,
     claudeCodeProcessHookHandler
   ).command(
     mobbCliCommand.claudeCodeDaemon,
-    chalk15.bold(
+    chalk16.bold(
       "Run the background daemon for Claude Code transcript processing."
     ),
     claudeCodeDaemonBuilder,
     claudeCodeDaemonHandler
   ).command(
     mobbCliCommand.windsurfIntellijInstallHook,
-    chalk15.bold("Install Windsurf IntelliJ hooks for data collection."),
+    chalk16.bold("Install Windsurf IntelliJ hooks for data collection."),
     windsurfIntellijInstallHookBuilder,
     windsurfIntellijInstallHookHandler
   ).command(
     mobbCliCommand.windsurfIntellijProcessHook,
-    chalk15.bold("Process Windsurf IntelliJ hook data and upload to backend."),
+    chalk16.bold("Process Windsurf IntelliJ hook data and upload to backend."),
     windsurfIntellijProcessHookBuilder,
     windsurfIntellijProcessHookHandler
   ).example(
@@ -29198,7 +29381,7 @@ var parseArgs = async (args) => {
     handler() {
       yargsInstance.showHelp();
     }
-  }).strictOptions().help("h").alias("h", "help").epilog(chalk15.bgBlue("Made with \u2764\uFE0F by Mobb")).showHelpOnFail(true).wrap(Math.min(120, yargsInstance.terminalWidth())).parse();
+  }).strictOptions().help("h").alias("h", "help").epilog(chalk16.bgBlue("Made with \u2764\uFE0F by Mobb")).showHelpOnFail(true).wrap(Math.min(120, yargsInstance.terminalWidth())).parse();
 };
 
 // src/index.ts
@@ -29214,7 +29397,7 @@ async function run() {
   } catch (err) {
     if (err instanceof CliError) {
       console.error(err.message);
-      process.exit(1);
+      process.exit(err.exitCode);
     }
     console.error(
       "Something went wrong, please try again or contact support if issue persists."