🤖 Automated release via release-please
---


<details><summary>cli: 0.5.5</summary>

##
[0.5.5](cli-v0.5.4...cli-v0.5.5)
(2026-05-29)


### Bug Fixes

* **cli:** doctor resolves @opencodehub/sarif as installed pkg, not
monorepo path
([#164](#164))
([2b2b389](2b2b389))
* **scanners:** uv-first bandit[sarif] install + pip-audit
pyproject.toml support
([#166](#166))
([5ad02d8](5ad02d8))


### Dependencies

* The following workspace dependencies were updated
  * dependencies
    * @opencodehub/mcp bumped to 0.4.4
    * @opencodehub/scanners bumped to 0.2.2
</details>

<details><summary>mcp: 0.4.4</summary>

##
[0.4.4](mcp-v0.4.3...mcp-v0.4.4)
(2026-05-29)


### Dependencies

* The following workspace dependencies were updated
  * dependencies
    * @opencodehub/scanners bumped to 0.2.2
</details>

<details><summary>scanners: 0.2.2</summary>

##
[0.2.2](scanners-v0.2.1...scanners-v0.2.2)
(2026-05-29)


### Bug Fixes

* **scanners:** uv-first bandit[sarif] install + pip-audit
pyproject.toml support
([#166](#166))
([5ad02d8](5ad02d8))
</details>

<details><summary>root: 0.6.6</summary>

##
[0.6.6](root-v0.6.5...root-v0.6.6)
(2026-05-29)


### Bug Fixes

* **cli:** doctor resolves @opencodehub/sarif as installed pkg, not
monorepo path
([#164](#164))
([2b2b389](2b2b389))
* **scanners:** uv-first bandit[sarif] install + pip-audit
pyproject.toml support
([#166](#166))
([5ad02d8](5ad02d8))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…inary (#171)

## Summary

`doctor` reported **bandit OK** from `bandit --version` exit 0 — while
`codehub scan` was silently broken. Without the `[sarif]` extra
(`bandit-sarif-formatter`), `bandit -f sarif` is argparse-rejected (exit
2 + a `usage: bandit` banner) and the scan contributes **0 findings**.
The check was a false positive (field-report Issue 6).

## Fix

- **`banditSarifCheck`** replaces the bandit `binaryOnPathCheck`. It
probes `bandit --version` (missing → `warn`), then runs `bandit -f sarif
--quiet -r <empty tmp dir>`. argparse validates the `--format` choice
**before** walking any target, so a missing formatter fails fast (~0.1s)
without scanning the repo. The fail branch gates on the **structural**
signature (exit 2 + `usage: bandit` banner) — not advisory prose — so it
can't silently regress if the message is reworded. Row name stays
`"bandit binary"` (preserves `--strict` exit accounting and table
order).
- **`runCommand` DI seam** added to `DoctorOptions`, threaded into the
spawning checks (pnpm, scip indexers, `binaryOnPathCheck`,
`banditSarifCheck`). This makes doctor tests hermetic and de-flakes the
pre-existing strict-exit test, which previously depended on whatever
scanner binaries the host happened to have installed.

## Test plan

- [x] **On this host:** doctor reports **FAIL** for the PATH bandit
lacking the extra (`mise pipx-bandit`), and **OK** for the uv-tool
`bandit[sarif]`.
- [x] 3 new tests via the DI seam: formatter-missing (exit 2 + usage) →
`fail` with a `bandit[sarif]` hint; formatter-present → `ok`;
binary-absent → `warn`.
- [x] `@opencodehub/cli` 266/266; `tsc` + `biome` clean.

Companion to #166 (which fixed the `installCmd` the hint points at).