mobbdev 1.4.68 → 1.5.0

package/dist/args/commands/upload_ai_blame.mjs

@@ -34,6 +34,18 @@ function getSdk(client, withWrapper = defaultWrapper) {
     getAnalysisSubscription(variables, requestHeaders, signal) {
       return withWrapper((wrappedRequestHeaders) => client.request({ document: GetAnalysisSubscriptionDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "getAnalysisSubscription", "subscription", variables);
     },
+    GetOrganizationId(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: GetOrganizationIdDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "GetOrganizationId", "query", variables);
+    },
+    UpdateOrgScanPolicy(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: UpdateOrgScanPolicyDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "UpdateOrgScanPolicy", "mutation", variables);
+    },
+    GetReportFindingRuleIds(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: GetReportFindingRuleIdsDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "GetReportFindingRuleIds", "query", variables);
+    },
+    getGateVerdict(variables, requestHeaders, signal) {
+      return withWrapper((wrappedRequestHeaders) => client.request({ document: GetGateVerdictDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "getGateVerdict", "query", variables);
+    },
     getAnalysis(variables, requestHeaders, signal) {
       return withWrapper((wrappedRequestHeaders) => client.request({ document: GetAnalysisDocument, variables, requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders }, signal }), "getAnalysis", "query", variables);
     },
@@ -150,7 +162,7 @@ function getSdk(client, withWrapper = defaultWrapper) {
     }
   };
 }
-var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Scan_Source_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
+var AiBlameInferenceType, FixQuestionInputType, Language, ManifestAction, Effort_To_Apply_Fix_Enum, Fix_Rating_Tag_Enum, Fix_Report_State_Enum, Fix_State_Enum, IssueLanguage_Enum, Pr_Status_Enum, Project_Role_Type_Enum, Scan_Source_Enum, Vulnerability_Report_Issue_Category_Enum, Vulnerability_Report_Issue_State_Enum, Vulnerability_Report_Issue_Tag_Enum, Vulnerability_Report_Vendor_Enum, Vulnerability_Severity_Enum, FixDetailsFragmentDoc, FixReportSummaryFieldsFragmentDoc, MeDocument, GetLastOrgAndNamedProjectDocument, GetLastOrgDocument, GetEncryptedApiTokenDocument, FixReportStateDocument, GetVulnerabilityReportPathsDocument, GetAnalysisSubscriptionDocument, GetOrganizationIdDocument, UpdateOrgScanPolicyDocument, GetReportFindingRuleIdsDocument, GetGateVerdictDocument, GetAnalysisDocument, GetFixesDocument, GetVulByNodesMetadataDocument, GetFalsePositiveDocument, UpdateScmTokenDocument, UploadS3BucketInfoDocument, GetTracyDiffUploadUrlDocument, AnalyzeCommitForExtensionAiBlameDocument, GetAiBlameInferenceDocument, GetAiBlameAttributionPromptDocument, GetPromptSummaryDocument, UploadAiBlameInferencesInitDocument, FinalizeAiBlameInferencesUploadDocument, UploadTracyRecordsDocument, GetTracyRawDataUploadUrlDocument, DigestVulnerabilityReportDocument, SubmitVulnerabilityReportDocument, CreateCommunityUserDocument, CreateCliLoginDocument, PerformCliLoginDocument, SetQuarantineEnabledDocument, CreateProjectDocument, ValidateRepoUrlDocument, GitReferenceDocument, AutoPrAnalysisDocument, GetFixWithAnswersDocument, GetFixReportsByRepoUrlDocument, GetReportFixesDocument, GetLatestReportByRepoUrlDocument, UpdateDownloadedFixDataDocument, GetUserMvsAutoFixDocument, StreamBlameAiAnalysisRequestsDocument, StreamCommitBlameRequestsDocument, ScanSkillDocument, SkillVerdictsByMd5Document, LogMvsEventDocument, GetMvsProjectDocument, IssueTypesDocument, defaultWrapper;
 var init_client_generates = __esm({
   "src/features/analysis/scm/generates/client_generates.ts"() {
     "use strict";
@@ -558,6 +570,66 @@ var init_client_generates = __esm({
     state
     failReason
   }
+}
+    `;
+    GetOrganizationIdDocument = `
+    query GetOrganizationId {
+  organization {
+    id
+  }
+}
+    `;
+    UpdateOrgScanPolicyDocument = `
+    mutation UpdateOrgScanPolicy($organizationId: String!, $policyJson: String) {
+  updateOrganizationScanPolicy(
+    organizationId: $organizationId
+    policyJson: $policyJson
+  ) {
+    __typename
+    ... on ScanPolicyUpdateSuccess {
+      storedPolicyJson
+      warnings
+    }
+    ... on ScanPolicyValidationError {
+      error
+    }
+  }
+}
+    `;
+    GetReportFindingRuleIdsDocument = `
+    query GetReportFindingRuleIds($fixReportId: uuid!) {
+  fixReport_by_pk(id: $fixReportId) {
+    vulnerabilityReport {
+      vulnerabilityReportIssues {
+        extraData(path: "rule_id")
+      }
+    }
+  }
+}
+    `;
+    GetGateVerdictDocument = `
+    query getGateVerdict($fixReportId: String!) {
+  getGateVerdict(fixReportId: $fixReportId) {
+    __typename
+    ... on GateVerdictSuccess {
+      blocking
+      blockingCount
+      totalIssues
+      criticalCount
+      highCount
+      mediumCount
+      lowCount
+      unclassifiedCount
+      description
+      degraded
+    }
+    ... on GateVerdictNotReady {
+      state
+    }
+    ... on GateVerdictError {
+      error
+    }
+  }
 }
     `;
     GetAnalysisDocument = `
@@ -643,35 +715,20 @@ var init_client_generates = __esm({
 }
     `;
     GetVulByNodesMetadataDocument = `
-    query getVulByNodesMetadata($filters: [vulnerability_report_issue_code_node_bool_exp!], $vulnerabilityReportId: uuid!) {
-  vulnerabilityReportIssueCodeNodes: vulnerability_report_issue_code_node(
-    order_by: {index: desc}
-    where: {_or: $filters, vulnerabilityReportIssue: {fixId: {_is_null: false}, vulnerabilityReportId: {_eq: $vulnerabilityReportId}}}
+    query getVulByNodesMetadata($pathFilters: [vulnerability_report_issue_bool_exp!], $vulnerabilityReportId: uuid!) {
+  vulnerabilityReportIssues: vulnerability_report_issue(
+    where: {vulnerabilityReportId: {_eq: $vulnerabilityReportId}, _or: $pathFilters}
   ) {
-    vulnerabilityReportIssueId
-    path
-    startLine
-    vulnerabilityReportIssue {
-      safeIssueType
-      fixId
-      category
-      vulnerabilityReportIssueTags {
-        tag: vulnerability_report_issue_tag_value
-      }
+    id
+    safeIssueType
+    fixId
+    fpId
+    category
+    vulnerabilityReportIssueTags {
+      tag: vulnerability_report_issue_tag_value
     }
-  }
-  fixablePrVuls: vulnerability_report_issue_aggregate(
-    where: {fixId: {_is_null: false}, vulnerabilityReportId: {_eq: $vulnerabilityReportId}, codeNodes: {_or: $filters}}
-  ) {
-    aggregate {
-      count
-    }
-  }
-  nonFixablePrVuls: vulnerability_report_issue_aggregate(
-    where: {fixId: {_is_null: true}, vulnerabilityReportId: {_eq: $vulnerabilityReportId}, codeNodes: {_or: $filters}}
-  ) {
-    aggregate {
-      count
+    codeNodesJson {
+      nodes
     }
   }
   totalScanVulnerabilities: vulnerability_report_issue_aggregate(
@@ -681,26 +738,6 @@ var init_client_generates = __esm({
       count
     }
   }
-  irrelevantVulnerabilityReportIssue: vulnerability_report(
-    where: {id: {_eq: $vulnerabilityReportId}}
-  ) {
-    vulnerabilityReportIssues(
-      where: {fixId: {_is_null: true}, category: {_in: [Irrelevant, FalsePositive, Filtered]}, _not: {vulnerabilityReportIssueTags: {vulnerability_report_issue_tag_value: {_eq: SUPPRESSED}}}}
-    ) {
-      id
-      safeIssueType
-      fixId
-      category
-      vulnerabilityReportIssueTags {
-        tag: vulnerability_report_issue_tag_value
-      }
-      codeNodes(order_by: {index: desc}, where: {_or: $filters}, limit: 1) {
-        path
-        startLine
-      }
-      fpId
-    }
-  }
 }
     `;
     GetFalsePositiveDocument = `
@@ -1815,7 +1852,7 @@ var init_validations = __esm({
 
 // src/features/analysis/scm/shared/src/types/types.ts
 import { z as z7 } from "zod";
-var OrganizationScreenQueryParamsZ, ProjectPageQueryParamsZ, AnalysisPageQueryParamsZ, FixPageQueryParamsZ, IssuePageQueryParamsZ, CliLoginPageQueryParamsZ, AnalysisReportDigestedZ, IssueSharedStateZ2, ReportQueryResultZ, ReportFixesQueryFixZ, BaseVulnerabilityReportIssueZ, VulnerabilityReportIssueZ, VulnerabilityReportIssueWithCodeFilePathZ, GetReportIssuesQueryZ, FixReportByProjectZ, FixScreenQueryResultZ, FixPageQueryZ, GetReportFixesQueryZ, GetFixReportStatsQueryZ, ProjectVulnerabilityReport, GetProjectsQueryZ, ProjectPageQueryResultZ, GetProjectMembersDataZ, RepoArgsZ, scmCloudUrl, ScmType;
+var OrganizationScreenQueryParamsZ, ProjectPageQueryParamsZ, AnalysisPageQueryParamsZ, FixPageQueryParamsZ, IssuePageQueryParamsZ, CliLoginPageQueryParamsZ, AnalysisReportDigestedZ, IssueSharedStateZ2, ReportQueryResultZ, ReportFixesQueryFixZ, BaseVulnerabilityReportIssueZ, VulnerabilityReportIssueWithCodeFilePathZ, GetReportIssuesQueryZ, FixReportByProjectZ, FixScreenQueryResultZ, FixPageQueryZ, GetReportFixesQueryZ, GetFixReportStatsQueryZ, ProjectVulnerabilityReport, GetProjectsQueryZ, ProjectPageQueryResultZ, GetProjectMembersDataZ, RepoArgsZ, scmCloudUrl, ScmType;
 var init_types = __esm({
   "src/features/analysis/scm/shared/src/types/types.ts"() {
     "use strict";
@@ -2077,11 +2114,6 @@ var init_types = __esm({
       ),
       sharedState: VulnerabilityReportIssueSharedStateZ
     });
-    VulnerabilityReportIssueZ = BaseVulnerabilityReportIssueZ.extend(
-      z7.object({
-        codeNodes: z7.array(z7.object({ path: z7.string() }))
-      }).shape
-    );
     VulnerabilityReportIssueWithCodeFilePathZ = BaseVulnerabilityReportIssueZ.extend(
       z7.object({
         codeFilePath: z7.string().nullable()
@@ -4354,6 +4386,17 @@ var defaultLogger = {
 // src/utils/index.ts
 var sleep = (ms = 2e3) => new Promise((r) => setTimeout(r, ms));
 var CliError = class extends Error {
+  constructor(message, options = {}) {
+    super(message);
+    /**
+     * The process exit code index.ts maps this error to. Defaults to 1 (plain
+     * operational error) so every existing throw keeps its behavior; 2 means the
+     * gate policy blocked the run (MOBB-3810), so CI can tell "your code is
+     * gated" from "the tool broke".
+     */
+    __publicField(this, "exitCode");
+    this.exitCode = options.exitCode ?? 1;
+  }
 };
 
 // src/commands/AuthManager.ts
@@ -4959,65 +5002,104 @@ init_client_generates();
 // src/features/analysis/graphql/types.ts
 init_client_generates();
 import { z as z22 } from "zod";
-var VulnerabilityReportIssueCodeNodeZ = z22.object({
-  vulnerabilityReportIssueId: z22.string(),
+function codeNodesJsonPathFilter(path7) {
+  return { codeNodesJson: { nodes: { _contains: [{ path: path7 }] } } };
+}
+var VulByNodesMetadataCodeNodeZ = z22.object({
+  index: z22.number().int(),
   path: z22.string(),
-  startLine: z22.number(),
-  vulnerabilityReportIssue: z22.object({
-    fixId: z22.string(),
-    category: z22.enum(Vulnerability_Report_Issue_Category_Enum),
-    safeIssueType: z22.string(),
-    vulnerabilityReportIssueTags: z22.array(
-      z22.object({
-        tag: z22.enum(Vulnerability_Report_Issue_Tag_Enum)
-      })
-    )
-  })
-});
-var VulnerabilityReportIssueNoFixCodeNodeZ = z22.object({
-  vulnerabilityReportIssues: z22.array(
+  startLine: z22.number().int(),
+  endLine: z22.number().int()
+}).loose();
+var VulnerabilityReportIssueWithNodesZ = z22.object({
+  id: z22.string(),
+  fixId: z22.string().nullable(),
+  category: z22.enum(Vulnerability_Report_Issue_Category_Enum),
+  safeIssueType: z22.string(),
+  fpId: z22.guid().nullable(),
+  vulnerabilityReportIssueTags: z22.array(
     z22.object({
-      id: z22.string(),
-      fixId: z22.string().nullable(),
-      category: z22.enum(Vulnerability_Report_Issue_Category_Enum),
-      safeIssueType: z22.string(),
-      fpId: z22.guid().nullable(),
-      codeNodes: z22.array(
-        z22.object({
-          path: z22.string(),
-          startLine: z22.number()
-        })
-      ),
-      vulnerabilityReportIssueTags: z22.array(
-        z22.object({
-          tag: z22.enum(Vulnerability_Report_Issue_Tag_Enum)
-        })
-      )
+      tag: z22.enum(Vulnerability_Report_Issue_Tag_Enum)
     })
-  )
+  ),
+  codeNodesJson: z22.object({ nodes: z22.unknown() }).nullable()
 });
 var GetVulByNodesMetadataZ = z22.object({
-  vulnerabilityReportIssueCodeNodes: z22.array(VulnerabilityReportIssueCodeNodeZ),
-  nonFixablePrVuls: z22.object({
-    aggregate: z22.object({
-      count: z22.number()
-    })
-  }),
-  fixablePrVuls: z22.object({
-    aggregate: z22.object({
-      count: z22.number()
-    })
-  }),
+  vulnerabilityReportIssues: z22.array(VulnerabilityReportIssueWithNodesZ),
   totalScanVulnerabilities: z22.object({
     aggregate: z22.object({
       count: z22.number()
     })
-  }),
-  irrelevantVulnerabilityReportIssue: z22.array(
-    VulnerabilityReportIssueNoFixCodeNodeZ
-  )
+  })
 });
 
+// src/features/analysis/graphql/matchVulByNodesMetadata.ts
+var IRRELEVANT_CATEGORIES = /* @__PURE__ */ new Set([
+  "Irrelevant",
+  "FalsePositive",
+  "Filtered"
+]);
+var SUPPRESSED_TAG = "SUPPRESSED";
+function nodeMatchesHunks(node, hunks) {
+  return hunks.some(
+    (hunk) => hunk.path === node.path && hunk.ranges.some(
+      ({ startLine, endLine }) => node.startLine >= startLine && node.startLine <= endLine || node.endLine >= startLine && node.endLine <= endLine
+    )
+  );
+}
+function matchingNodes(issue, hunks) {
+  const rawNodes = issue.codeNodesJson?.nodes;
+  if (!Array.isArray(rawNodes)) {
+    return [];
+  }
+  return rawNodes.map((rawNode) => VulByNodesMetadataCodeNodeZ.safeParse(rawNode)).filter((parsed) => parsed.success).map((parsed) => parsed.data).filter((node) => nodeMatchesHunks(node, hunks)).sort((a, b) => b.index - a.index);
+}
+function matchVulByNodesMetadata(issues, hunks) {
+  const vulnerabilityReportIssueCodeNodes = [];
+  let fixablePrVuls = 0;
+  let nonFixablePrVuls = 0;
+  const irrelevantVulnerabilityReportIssues = [];
+  for (const issue of issues) {
+    const nodes = matchingNodes(issue, hunks);
+    const bestNode = nodes[0];
+    if (issue.fixId !== null && bestNode) {
+      fixablePrVuls += 1;
+      vulnerabilityReportIssueCodeNodes.push({
+        vulnerabilityReportIssueId: issue.id,
+        path: bestNode.path,
+        startLine: bestNode.startLine,
+        vulnerabilityReportIssue: {
+          fixId: issue.fixId,
+          category: issue.category,
+          safeIssueType: issue.safeIssueType,
+          vulnerabilityReportIssueTags: issue.vulnerabilityReportIssueTags
+        }
+      });
+    } else if (issue.fixId === null && bestNode) {
+      nonFixablePrVuls += 1;
+    }
+    if (issue.fixId === null && IRRELEVANT_CATEGORIES.has(issue.category) && !issue.vulnerabilityReportIssueTags.some(
+      (issueTag) => issueTag.tag === SUPPRESSED_TAG
+    )) {
+      irrelevantVulnerabilityReportIssues.push({
+        id: issue.id,
+        safeIssueType: issue.safeIssueType,
+        fixId: issue.fixId,
+        category: issue.category,
+        vulnerabilityReportIssueTags: issue.vulnerabilityReportIssueTags,
+        codeNodes: bestNode ? [{ path: bestNode.path, startLine: bestNode.startLine }] : [],
+        fpId: issue.fpId
+      });
+    }
+  }
+  return {
+    vulnerabilityReportIssueCodeNodes,
+    fixablePrVuls,
+    nonFixablePrVuls,
+    irrelevantVulnerabilityReportIssues
+  };
+}
+
 // src/features/analysis/graphql/gql.ts
 var debug7 = Debug6("mobbdev:gql");
 function isAuthError(error) {
@@ -5225,44 +5307,28 @@ var GQLClient = class {
     hunks,
     vulnerabilityReportId
   }) {
-    const filters = hunks.map((hunk) => {
-      const filter = {
-        path: { _eq: hunk.path },
-        _or: hunk.ranges.flatMap(({ endLine, startLine }) => {
-          return [
-            { startLine: { _gte: startLine, _lte: endLine } },
-            { endLine: { _gte: startLine, _lte: endLine } }
-          ];
-        })
-      };
-      return filter;
-    });
+    const pathFilters = hunks.map((hunk) => codeNodesJsonPathFilter(hunk.path));
     const getVulByNodesMetadataRes = await this._clientSdk.getVulByNodesMetadata({
-      filters: { _or: filters },
+      pathFilters,
       vulnerabilityReportId
     });
     const parsedGetVulByNodesMetadataRes = GetVulByNodesMetadataZ.parse(
       getVulByNodesMetadataRes
     );
-    const uniqueVulByNodesMetadata = parsedGetVulByNodesMetadataRes.vulnerabilityReportIssueCodeNodes.reduce((acc, vulnerabilityReportIssueCodeNode) => {
-      if (acc[vulnerabilityReportIssueCodeNode.vulnerabilityReportIssueId]) {
-        return acc;
-      }
-      return {
-        ...acc,
-        [vulnerabilityReportIssueCodeNode.vulnerabilityReportIssueId]: vulnerabilityReportIssueCodeNode
-      };
-    }, {});
-    const nonFixablePrVuls = parsedGetVulByNodesMetadataRes.nonFixablePrVuls.aggregate.count;
-    const fixablePrVuls = parsedGetVulByNodesMetadataRes.fixablePrVuls.aggregate.count;
+    const {
+      vulnerabilityReportIssueCodeNodes,
+      fixablePrVuls,
+      nonFixablePrVuls,
+      irrelevantVulnerabilityReportIssues
+    } = matchVulByNodesMetadata(
+      parsedGetVulByNodesMetadataRes.vulnerabilityReportIssues,
+      hunks
+    );
     const totalScanVulnerabilities = parsedGetVulByNodesMetadataRes.totalScanVulnerabilities.aggregate.count;
     const vulnerabilitiesOutsidePr = totalScanVulnerabilities - nonFixablePrVuls - fixablePrVuls;
     const totalPrVulnerabilities = nonFixablePrVuls + fixablePrVuls;
-    const irrelevantVulnerabilityReportIssues = parsedGetVulByNodesMetadataRes.irrelevantVulnerabilityReportIssue?.[0]?.vulnerabilityReportIssues ?? [];
     return {
-      vulnerabilityReportIssueCodeNodes: Object.values(
-        uniqueVulByNodesMetadata
-      ),
+      vulnerabilityReportIssueCodeNodes,
       nonFixablePrVuls,
       fixablePrVuls,
       totalScanVulnerabilities,
@@ -5470,6 +5536,14 @@ var GQLClient = class {
     }
     return res.analysis;
   }
+  /**
+   * The gate verdict for a Mobb-scan report (MOBB-3810). The backend is the
+   * only decider; the caller maps the answer onto an exit code.
+   */
+  async getGateVerdict(fixReportId) {
+    const res = await this._clientSdk.getGateVerdict({ fixReportId });
+    return res.getGateVerdict;
+  }
   async autoPrAnalysis({
     analysisId,
     commitDirectly,