Merge pull request #46 from CodeAnt-AI/pranav/scans-dismiss-fp-overrides

Duplicate code, dismissed/FP markers, and issue overrides in scans (0.5.8)

Author: pranavcodeant

changelog.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.5.9] - 02/10/2026
+- Added `duplicate_code` to `scans results` / `findings repo`
+- Dismissed and false-positive flags are kept on IaC and dead-code findings, and shown as `metadata.dismissed` / `metadata.false_positive`
+- Added `scans overrides` (and the `codeant_scans_overrides` MCP tool) for user false-positive, confidence, and severity overrides
+- `scans dismissed` accepts every analysis type and no longer drops SCA dismissals
+- SCA severity is read from the advisory rating instead of defaulting to medium
+- Extra dead-code file paths no longer end in the result file name
+- Removed a debug dump of full scan responses to stderr
+- Fixed numeric options with defaults (`scans results --limit`, `scans history --limit`, PR comment `--limit`) being parsed in the wrong radix; numeric options now reject non-integers, negative values, zero counts, and values above the documented maximum
+- The dismissal comment (`metadata.comment_for_dismiss`) and secrets with a `FALSE_POSITIVE` confidence are reported in `metadata`
+
 ## [0.5.8] - 02/10/2026
 - `findings antipatterns` and VM/container `findings cloud list` are paged (`--limit`, `--offset`, `--all`), so large organizations and scans no longer fail with a 502
 

findings.md

@@ -49,9 +49,9 @@ codeant findings repo \
   --output codeant.sarif
 ```
 
-Supported repo types are `sast`, `sca`, `secrets`, `iac`, `dead_code`, `sbom`, `anti_patterns`, `docstring`, and `complex_functions`. Use `--types all` for all of them. Formats are `json`, `sarif`, `csv`, `md`, and `table`; JSON is the default.
+Supported repo types are `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, and `complex_functions`. Use `--types all` for all of them. Formats are `json`, `sarif`, `csv`, `md`, and `table`; JSON is the default.
 
-Use `--filter-dismissed` to exclude dismissed findings and `--no-false-positives` to exclude false positives. `--path`, `--check`, `--limit`, and `--offset` support agent-friendly filtering and pagination.
+Use `--filter-dismissed` to exclude dismissed findings and `--no-false-positives` to exclude false positives, including ones users marked in the app. Without those flags, such findings are returned with `metadata.dismissed` or `metadata.false_positive`. `--path`, `--check`, `--limit`, and `--offset` support agent-friendly filtering and pagination.
 
 ## Organization Hotlist findings
 

mcp.md

@@ -15,7 +15,8 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | `codeant_scans_history` | read | Recent scan runs for a repo. |
 | `codeant_scans_get` | read | Severity/category summary for one scan. |
 | `codeant_scans_results` | read | Full findings (SAST, SCA, secrets, IaC, …) for one scan. |
-| `codeant_scans_dismissed` | read | Dismissed alerts for a repo. |
+| `codeant_scans_dismissed` | read | Dismissed alerts for a repo (any analysis type; `sast` and `anti_patterns` are accepted as aliases). |
+| `codeant_scans_overrides` | read | User false-positive, confidence, and severity overrides for a repo. |
 | `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
 | `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |
 | `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos (paged: `limit`, `offset`, `all`). |

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "Code review CLI tool",
   "type": "module",
   "repository": {
@@ -36,6 +36,7 @@
     "./scans/fetch-results": "./src/scans/fetchScanResults.js",
     "./scans/fetch-advanced-results": "./src/scans/fetchAdvancedScanResults.js",
     "./scans/dismissed-alerts": "./src/scans/fetchDismissedAlerts.js",
+    "./scans/issue-overrides": "./src/scans/fetchIssueOverrides.js",
     "./hotlist": "./src/hotlist/client.js",
     "./findings/cloud": "./src/findings/cloud.js",
     "./findings/pentest": "./src/findings/pentest.js",

package.json

@@ -135,11 +135,12 @@ codeant scans results --repo <owner/repo> [options]
 | `--repo <repo>` | **(required)** Repository in `owner/repo` format |
 | `--scan <sha>` | Specific commit SHA to use |
 | `--branch <name>` | Resolve latest scan on this branch |
-| `--types <list>` | Comma-separated types: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all` (default: `all`) |
+| `--types <list>` | Comma-separated types: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all` (default: `all`) |
 | `--severity <list>` | Filter by severity (e.g. `critical,high`) |
 | `--path <glob>` | Filter by file path glob |
 | `--check <regex>` | Filter by check ID or name (regex) |
-| `--include-dismissed` | Include dismissed findings (excluded by default) |
+| `--filter-dismissed` | Exclude dismissed findings (included by default, marked `metadata.dismissed`) |
+| `--no-false-positives` | Exclude false positives, including ones users marked in the app (included by default, marked `metadata.false_positive`) |
 | `--format <fmt>` | Output format: `json`, `sarif`, `csv`, `md`, `table` (default: `json`) |
 | `--output <path>` | Write output to file instead of stdout |
 | `--fields <list>` | Project findings to a subset of fields (comma-separated) |
@@ -173,8 +174,8 @@ codeant scans results --repo acme/backend --format md
 # Output as SARIF to a file
 codeant scans results --repo acme/backend --format sarif --output results.sarif
 
-# Include dismissed findings
-codeant scans results --repo acme/backend --include-dismissed
+# Only open findings: drop dismissed findings and false positives
+codeant scans results --repo acme/backend --filter-dismissed --no-false-positives
 
 # Paginate through results
 codeant scans results --repo acme/backend --limit 50 --offset 100
@@ -206,7 +207,7 @@ codeant scans dismissed --repo <owner/repo> [options]
 | Option | Description |
 |--------|-------------|
 | `--repo <repo>` | **(required)** Repository in `owner/repo` format |
-| `--analysis-type <type>` | Analysis type: `security` or `secrets` (default: `security`) |
+| `--analysis-type <type>` | `security`, `secrets`, `sca`, `iac`, `antipatterns`, `docstring`, `complex_functions`, `dead_code`, or `duplicate_code` (default: `security`). Result-type names `sast` and `anti_patterns` are accepted too. |
 
 **Examples:**
 
@@ -220,6 +221,16 @@ codeant scans dismissed --repo acme/backend --analysis-type secrets
 
 ---
 
+### `scans overrides`
+
+List the per-finding overrides users set in the CodeAnt app: Mark/Unmark false positive (`security`, `iac`), secrets confidence (`secrets`), and Change Severity (`security`, `sca`). `scans results` already applies them.
+
+```bash
+codeant scans overrides --repo <owner/repo> [--analysis-type security|secrets|iac|sca]
+```
+
+---
+
 ### `scans start-scan`
 
 Trigger a new analysis run for a repository.

scans.md

@@ -1,16 +1,34 @@
 import { fetchDismissedAlerts } from '../../scans/fetchDismissedAlerts.js';
+import { fetchIssueOverrides } from '../../scans/fetchIssueOverrides.js';
 
-/**
- * codeant scans dismissed --repo <repo> [--analysis-type security|secrets]
- */
-export async function runDismissed({ repo, analysisType = 'security' } = {}) {
+// Result-type names (`scans results --types`) → the names dismissals and
+// overrides are stored under.
+const STORE_ANALYSIS_TYPES = {
+  sast: 'security',
+  security_issues: 'security',
+  anti_patterns: 'antipatterns',
+};
+
+export function storeAnalysisType(analysisType) {
+  return STORE_ANALYSIS_TYPES[analysisType] || analysisType;
+}
+
+function requireRepo(repo) {
   if (!repo) {
     const err = new Error('--repo is required');
     err.exitCode = 1;
     throw err;
   }
+}
+
+/**
+ * codeant scans dismissed --repo <repo> [--analysis-type <type>]
+ */
+export async function runDismissed({ repo, analysisType = 'security' } = {}) {
+  requireRepo(repo);
+  const type = storeAnalysisType(analysisType);
 
-  const result = await fetchDismissedAlerts(repo, analysisType);
+  const result = await fetchDismissedAlerts(repo, type);
   if (!result.success) {
     const err = new Error(result.error || 'Failed to fetch dismissed alerts');
     err.exitCode = 1;
@@ -19,8 +37,30 @@ export async function runDismissed({ repo, analysisType = 'security' } = {}) {
 
   return {
     repo,
-    analysis_type: analysisType,
+    analysis_type: type,
     total: result.dismissedAlerts.length,
     dismissed_alerts: result.dismissedAlerts,
   };
 }
+
+/**
+ * codeant scans overrides --repo <repo> [--analysis-type security|secrets|iac|sca]
+ */
+export async function runOverrides({ repo, analysisType = 'security' } = {}) {
+  requireRepo(repo);
+  const type = storeAnalysisType(analysisType);
+
+  const result = await fetchIssueOverrides(repo, type);
+  if (!result.success) {
+    const err = new Error(result.error || 'Failed to fetch issue overrides');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  return {
+    repo,
+    analysis_type: type,
+    total: Object.keys(result.overrides).length,
+    overrides: result.overrides,
+  };
+}

src/commands/scans/dismissed.js

@@ -3,10 +3,14 @@ import { runRepos } from './repos.js';
 import { runHistory } from './history.js';
 import { runGet } from './get.js';
 import { runResults } from './results.js';
-import { runDismissed } from './dismissed.js';
+import { runDismissed, runOverrides } from './dismissed.js';
 import { runStartScan } from './start-scan.js';
 import { setQuiet, setNoColor } from './lib/log.js';
 import { setNoColor as tableSetNoColor } from './formatters/table.js';
+import { intOption } from '../../utils/intOption.js';
+
+const toCount = intOption({ min: 1 });
+const toOffset = intOption();
 
 /**
  * Register all `codeant scans <verb>` subcommands.
@@ -37,7 +41,7 @@ export default function registerScansCommands(program, { runCmd }) {
     .requiredOption('--repo <repo>', 'Repository (owner/repo)')
     .option('--branch <name>', 'Filter by branch name')
     .option('--since <iso>', 'Show scans since ISO date')
-    .option('--limit <n>', 'Max results (default: 20)', parseInt, 20)
+    .option('--limit <n>', 'Max results (default: 20)', toCount, 20)
     .action((opts) =>
       runCmd(() => runHistory({ repo: opts.repo, branch: opts.branch, since: opts.since, limit: opts.limit }))
     );
@@ -65,7 +69,7 @@ export default function registerScansCommands(program, { runCmd }) {
     .option('--branch <name>', 'Resolve latest scan on this branch')
     .option(
       '--types <list>',
-      'Comma-separated types: sast,sca,secrets,iac,dead_code,sbom,anti_patterns,docstring,complex_functions,all',
+      'Comma-separated types: sast,sca,secrets,iac,dead_code,duplicate_code,sbom,anti_patterns,docstring,complex_functions,all',
       'all'
     )
     .option('--severity <list>', 'Filter by severity (e.g. critical,high)')
@@ -76,8 +80,8 @@ export default function registerScansCommands(program, { runCmd }) {
     .option('--format <fmt>', 'Output format: json|sarif|csv|md|table (default: json)', 'json')
     .option('--output <path>', 'Write output to file instead of stdout')
     .option('--fields <list>', 'Project findings to subset of fields (comma-separated)')
-    .option('--limit <n>', 'Max findings per page (default: 100)', parseInt, 100)
-    .option('--offset <n>', 'Pagination offset (default: 0)', parseInt, 0)
+    .option('--limit <n>', 'Max findings per page (default: 100)', toCount, 100)
+    .option('--offset <n>', 'Pagination offset (default: 0)', toOffset, 0)
     .option('--fail-fast', 'Exit 3 on first category fetch failure')
     .option('--no-color', 'Disable ANSI color (auto-disabled when not a TTY)')
     .option('--quiet', 'Suppress progress output on stderr')
@@ -117,11 +121,25 @@ export default function registerScansCommands(program, { runCmd }) {
     .command('dismissed')
     .description('List dismissed alerts for a repository')
     .requiredOption('--repo <repo>', 'Repository (owner/repo)')
-    .option('--analysis-type <type>', 'Analysis type: security|secrets (default: security)', 'security')
+    .option(
+      '--analysis-type <type>',
+      'Analysis type: security|secrets|sca|iac|antipatterns|docstring|complex_functions|dead_code|duplicate_code (default: security)',
+      'security'
+    )
     .action((opts) =>
       runCmd(() => runDismissed({ repo: opts.repo, analysisType: opts.analysisType }))
     );
 
+  // ── overrides ──────────────────────────────────────────────────────────────
+  scans
+    .command('overrides')
+    .description('List user overrides (false positive, confidence, severity) for a repository')
+    .requiredOption('--repo <repo>', 'Repository (owner/repo)')
+    .option('--analysis-type <type>', 'Analysis type: security|secrets|iac|sca (default: security)', 'security')
+    .action((opts) =>
+      runCmd(() => runOverrides({ repo: opts.repo, analysisType: opts.analysisType }))
+    );
+
   // ── start-scan ─────────────────────────────────────────────────────────────
   scans
     .command('start-scan')

src/commands/scans/index.js

@@ -10,6 +10,7 @@ import {
   fetchSecretsResults,
   fetchIacResults,
   fetchDeadCodeResults,
+  fetchDuplicateCodeResults,
 } from '../../../scans/fetchAdvancedScanResults.js';
 
 /**
@@ -26,6 +27,7 @@ export const CATEGORIES = {
   secrets:           { fetcher: fetchSecretsResults,          kind: 'secret' },
   iac:               { fetcher: fetchIacResults,              kind: 'config' },
   dead_code:         { fetcher: fetchDeadCodeResults,         kind: 'code' },
+  duplicate_code:    { fetcher: fetchDuplicateCodeResults,    kind: 'code' },
 };
 
 /**

src/commands/scans/lib/categories.js

@@ -87,6 +87,20 @@ export function normalizeIssue(issue, category) {
   } else if (category === 'sca') {
     if (issue.cvss_score !== undefined) metadata.cvss_score = issue.cvss_score;
     if (issue.fix_version) metadata.fix_version = issue.fix_version;
+  } else if (category === 'duplicate_code') {
+    if (issue.duplicate_group !== undefined) metadata.duplicate_group = issue.duplicate_group;
+    if (issue.duplicate_locations) metadata.duplicate_locations = issue.duplicate_locations;
+  }
+
+  // Backend dispositions, present when dismissed / false positives are not filtered out.
+  if (issue.is_dismissed === true) {
+    metadata.dismissed = true;
+    if (issue.reason_for_dismiss) metadata.reason_for_dismiss = issue.reason_for_dismiss;
+    if (issue.comment_for_dismiss) metadata.comment_for_dismiss = issue.comment_for_dismiss;
+  }
+  // Secrets from older backends only carry the FALSE_POSITIVE confidence.
+  if (issue.is_false_positive === true || String(issue.confidence_score || '').toUpperCase() === 'FALSE_POSITIVE') {
+    metadata.false_positive = true;
   }
 
   const id = buildId(category, filePath, lineNumber, checkId, message);