Merge main into pranav/scans-dismiss-fp-overrides

Keeps 0.5.9 for this branch, with main's 0.5.8 changelog entry below it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: pranavcodeant

changelog.md

@@ -10,6 +10,9 @@
 - Removed a debug dump of full scan responses to stderr
 - Fixed numeric options with defaults (`scans results --limit`, `scans history --limit`, PR comment `--limit`) being parsed in the wrong radix
 
+## [0.5.8] - 02/10/2026
+- `findings antipatterns` and VM/container `findings cloud list` are paged (`--limit`, `--offset`, `--all`), so large organizations and scans no longer fail with a 502
+
 ## [0.5.7] - 28/09/2026
 - Login tokens are prefixed with `cli___` so CLI logins show up as CLI on the IDE users page
 

findings.md

@@ -75,9 +75,12 @@ codeant findings antipatterns --org CodeAnt-AI --service github
 codeant findings antipatterns \
   --org CodeAnt-AI --service github \
   --repos CodeAnt-AI/api,CodeAnt-AI/web
+
+# Every page, merged into one list
+codeant findings antipatterns --org CodeAnt-AI --service github --all
 ```
 
-When `--repos` is omitted, the CLI first lists the organization's repositories and sends all of them to the same aggregate anti-pattern endpoint used by the Quality Report UI.
+When `--repos` is omitted, the CLI first lists the organization's repositories and sends all of them to the aggregate anti-pattern endpoint. Results are paged because an organization-wide list can exceed the API's 1 MB response limit: `--limit` is 25, 100, or 500 (default 500), `--offset` is a multiple of `--limit` (default 0), and `--all` fetches every page from `--offset` on. Responses carry `total`, `limit`, and `offset`; `summary` and `total_issues` always cover every issue.
 
 ## Cloud security findings
 
@@ -98,8 +101,9 @@ codeant findings cloud history --provider all --kind container
 codeant findings cloud list --provider aws --scan-id <scan-id> --account-id <account-id>
 codeant findings cloud get --provider aws --scan-id <scan-id> --uid <finding-uid> --cloud-service iam
 
-# VM and container vulnerabilities use the same list/detail flow
+# VM and container vulnerabilities use the same list/detail flow (paged; --all merges every page)
 codeant findings cloud list --provider aws --kind vm --scan-id <scan-id>
+codeant findings cloud list --provider aws --kind container --scan-id <scan-id> --all
 codeant findings cloud get --provider gcp --kind container --scan-id <scan-id> --uid <finding-uid>
 
 # Azure requires the tenant ID
@@ -113,7 +117,7 @@ codeant findings cloud list \
   --framework cis
 ```
 
-`--kind` defaults to `cspm`; use `vm` or `container` for the other Cloud Security result views. CSPM `cloud list` supports `--cloud-service`, `--severity`, `--status`, `--framework`, and `--min-days-unused`. AWS additionally supports `--exploit-attempted-only`; Azure additionally supports `--subscription-id`. CSPM responses include `findings` and `dismissed_findings`; VM/container responses preserve their UI result payload unchanged.
+`--kind` defaults to `cspm`; use `vm` or `container` for the other Cloud Security result views. CSPM `cloud list` supports `--cloud-service`, `--severity`, `--status`, `--framework`, and `--min-days-unused`. AWS additionally supports `--exploit-attempted-only`; Azure additionally supports `--subscription-id`. CSPM responses include `findings` and `dismissed_findings`. VM/container responses keep the UI result payload, but `findings` is paged with the same `--limit`/`--offset`/`--all` options as anti-patterns and the response carries `total`; `findings_total` and `severity_rollup` still describe the whole scan.
 
 ## Pentest findings
 

mcp.md

@@ -19,9 +19,9 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | `codeant_scans_overrides` | read | User false-positive, confidence, and severity overrides for a repo. |
 | `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
 | `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |
-| `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos. |
+| `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos (paged: `limit`, `offset`, `all`). |
 | `codeant_cloud_scan_history` | read | AWS/Azure/GCP CSPM, VM, or container scan history. |
-| `codeant_cloud_findings_list` | read | Findings for one CSPM, VM, or container scan. |
+| `codeant_cloud_findings_list` | read | Findings for one CSPM, VM, or container scan (VM/container paged: `limit`, `offset`, `all`). |
 | `codeant_cloud_finding_get` | read | Full detail for one cloud finding UID. |
 | `codeant_pentest_history` | read | Pentest engagement history. |
 | `codeant_pentest_issues` | read | All available issues for a pentest engagement. |

src/commands/findings/index.js

@@ -54,6 +54,17 @@ function hotlistOptions(options) {
   };
 }
 
+function addPageOptions(command) {
+  return command
+    .option('--limit <n>', 'Page size: 25, 100, or 500', Number, 500)
+    .option('--offset <n>', 'Start offset, a multiple of --limit', Number, 0)
+    .option('--all', 'Fetch every page from --offset on', false);
+}
+
+function pageOptions(options) {
+  return { limit: options.limit, offset: options.offset, all: options.all };
+}
+
 function addCloudScopeOptions(command) {
   return addTenantOptions(command)
     .requiredOption('--provider <provider>', 'Cloud provider: aws, azure, or gcp')
@@ -157,9 +168,9 @@ export default function registerFindingsCommands(program, { runCmd }) {
       maxWaitSeconds: options.maxWait,
     })));
 
-  addTenantOptions(findings.command('antipatterns').description('List anti-pattern findings across selected or all organization repositories'))
+  addPageOptions(addTenantOptions(findings.command('antipatterns').description('List anti-pattern findings across selected or all organization repositories')))
     .option('--repos <repos>', 'Comma-separated owner/repo values; defaults to every repository')
-    .action((options) => runCmd(() => runOrganizationAntipatterns({ ...tenantOptions(options), repos: options.repos })));
+    .action((options) => runCmd(() => runOrganizationAntipatterns({ ...tenantOptions(options), ...pageOptions(options), repos: options.repos })));
 
   const cloud = findings.command('cloud').description('Cloud security CSPM, VM, and container findings');
   addTenantOptions(cloud.command('history').description('List cloud scan history, or latest scans'))
@@ -168,14 +179,14 @@ export default function registerFindingsCommands(program, { runCmd }) {
     .option('--latest', 'Return only latest CSPM scans')
     .action((options) => runCmd(() => runCloudHistory({ ...tenantOptions(options), provider: options.provider, kind: options.kind, latest: options.latest })));
 
-  addCloudScopeOptions(cloud.command('list').description('List findings for a cloud scan'))
+  addPageOptions(addCloudScopeOptions(cloud.command('list').description('List findings for a cloud scan (VM/container results are paged)')))
     .option('--severity <value>', 'Severity filter')
     .option('--status <value>', 'Finding status filter')
     .option('--framework <value>', 'Compliance framework filter')
     .option('--subscription-id <id>', 'Azure subscription ID filter')
     .option('--exploit-attempted-only', 'AWS findings with validation attempts only')
     .option('--min-days-unused <n>', 'Minimum unused age in days', Number)
-    .action((options) => runCmd(() => runCloudFindings(cloudOptions(options))));
+    .action((options) => runCmd(() => runCloudFindings({ ...cloudOptions(options), ...pageOptions(options) })));
 
   addCloudScopeOptions(cloud.command('get').description('Get one cloud finding with full detail'))
     .requiredOption('--uid <uid>', 'Finding UID')

src/findings/antipatterns.js

@@ -1,6 +1,6 @@
 import { resolveCliTenant } from '../api/tenant.js';
 import { runRepos } from '../commands/scans/repos.js';
-import { fetchAppApi } from '../utils/fetchApi.js';
+import { fetchPaginated } from './paginate.js';
 
 function splitRepos(value) {
   const values = Array.isArray(value) ? value : value ? [value] : [];
@@ -19,11 +19,12 @@ export async function runOrganizationAntipatterns(options = {}) {
   }
   if (repos.length === 0) throw new Error('No repositories are available for this organization.');
 
-  const result = await fetchAppApi(
-    '/explorer/quality/antipatterns',
-    'POST',
+  const result = await fetchPaginated(
+    '/explorer/quality/antipatterns/paginated',
     { ...tenant.requestBody, org: tenant.organization, repos },
     tenant,
+    'antipatterns',
+    options,
   );
   return { tenant: tenant.requestBody, ...result };
 }

src/findings/cloud.js

@@ -1,5 +1,6 @@
 import { resolveCliTenant } from '../api/tenant.js';
 import { fetchAppApi } from '../utils/fetchApi.js';
+import { fetchPaginated } from './paginate.js';
 
 const PROVIDERS = new Set(['aws', 'azure', 'gcp']);
 const KINDS = new Set(['cspm', 'vm', 'container']);
@@ -53,18 +54,13 @@ function optionalFilters(provider, options = {}) {
   return filters;
 }
 
-async function request(provider, kind, action, options = {}, extra = {}, resolvedTenant = null) {
+async function request(provider, kind, action, options = {}, extra = {}, resolvedTenant = null, pageKey = null) {
   const tenant = resolvedTenant || await resolveCliTenant(options);
-  const data = await fetchAppApi(
-    endpoint(provider, kind, action),
-    'POST',
-    {
-      ...tenant.requestBody,
-      username: tenant.organization,
-      ...extra,
-    },
-    tenant,
-  );
+  const path = endpoint(provider, kind, action);
+  const body = { ...tenant.requestBody, username: tenant.organization, ...extra };
+  const data = pageKey
+    ? await fetchPaginated(path, body, tenant, pageKey, options)
+    : await fetchAppApi(path, 'POST', body, tenant);
   return { tenant: tenant.requestBody, provider, kind, ...data };
 }
 
@@ -96,10 +92,14 @@ export async function runCloudFindings(options = {}) {
   const provider = normalizeProvider(options.provider);
   const kind = normalizeKind(options.kind);
   const scanId = requireValue(options.scanId, '--scan-id');
-  return request(provider, kind, kind === 'cspm' ? 'findings' : 'results', options, {
+  // VM/container scans can exceed the API's 1 MB response cap, so they are paged.
+  if (kind !== 'cspm') {
+    return request(provider, kind, 'results/paginated', options, { scan_id: scanId }, null, 'findings');
+  }
+  return request(provider, kind, 'findings', options, {
     scan_id: scanId,
-    ...(kind === 'cspm' ? providerScope(provider, options) : {}),
-    ...(kind === 'cspm' ? optionalFilters(provider, options) : {}),
+    ...providerScope(provider, options),
+    ...optionalFilters(provider, options),
   });
 }
 

src/findings/paginate.js

@@ -0,0 +1,32 @@
+import { fetchAppApi } from '../utils/fetchApi.js';
+
+const LIMITS = [25, 100, 500];
+// Every page re-reads the whole result server-side, so fetch a few at a time.
+const CONCURRENCY = 5;
+
+function pageParams(options) {
+  const limit = options.limit === undefined ? 500 : Number(options.limit);
+  const offset = options.offset === undefined ? 0 : Number(options.offset);
+  if (!LIMITS.includes(limit)) throw new Error(`--limit must be one of: ${LIMITS.join(', ')}.`);
+  if (!Number.isInteger(offset) || offset < 0 || offset % limit) {
+    throw new Error('--offset must be a non-negative multiple of --limit.');
+  }
+  return { limit, offset };
+}
+
+// One page of `key` from a backend /paginated endpoint (with its `total`), or
+// with `all` every page from `offset` on, merged into one list.
+export async function fetchPaginated(endpoint, body, tenant, key, options = {}) {
+  const { limit, offset } = pageParams(options);
+  const fetchPage = (pageOffset) => fetchAppApi(endpoint, 'POST', { ...body, limit, offset: pageOffset }, tenant);
+  const first = await fetchPage(offset);
+  if (!options.all) return first;
+
+  const offsets = [];
+  for (let next = offset + limit; next < first.total; next += limit) offsets.push(next);
+  const pages = [first];
+  for (let index = 0; index < offsets.length; index += CONCURRENCY) {
+    pages.push(...await Promise.all(offsets.slice(index, index + CONCURRENCY).map(fetchPage)));
+  }
+  return { ...first, [key]: pages.flatMap((page) => page[key] || []) };
+}

src/mcp/server.js

@@ -289,12 +289,15 @@ export async function startMcpServer() {
     'codeant_findings_antipatterns',
     {
       title: 'List organization anti-pattern findings',
-      description: 'Fetch anti-pattern findings across selected repositories, or every repository in the organization when repos is omitted.',
+      description: 'Fetch anti-pattern findings across selected repositories, or every repository in the organization when repos is omitted. Results are paged; the response carries total.',
       inputSchema: {
         org: z.string().optional(),
         service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
         providerBaseUrl: z.string().url().optional(),
         repos: z.array(z.string()).optional().describe('Repositories in owner/repo form. Omit to query every repository.'),
+        limit: z.union([z.literal(25), z.literal(100), z.literal(500)]).optional().describe('Page size (default 500).'),
+        offset: z.number().int().nonnegative().optional().describe('Start offset, a multiple of limit (default 0).'),
+        all: z.boolean().optional().describe('Fetch every page from offset on instead of one page.'),
       },
       annotations: READ,
     },
@@ -327,7 +330,7 @@ export async function startMcpServer() {
     'codeant_cloud_findings_list',
     {
       title: 'List cloud security findings',
-      description: 'Fetch findings for one AWS, Azure, or GCP CSPM, VM, or container scan using the same endpoint as the app.',
+      description: 'Fetch findings for one AWS, Azure, or GCP CSPM, VM, or container scan. VM and container results are paged (limit/offset/all) and carry total.',
       inputSchema: {
         org: z.string().optional(),
         service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
@@ -345,6 +348,9 @@ export async function startMcpServer() {
         subscriptionId: z.string().optional(),
         exploitAttemptedOnly: z.boolean().optional(),
         minDaysUnused: z.number().int().nonnegative().optional(),
+        limit: z.union([z.literal(25), z.literal(100), z.literal(500)]).optional().describe('Page size (default 500).'),
+        offset: z.number().int().nonnegative().optional().describe('Start offset, a multiple of limit (default 0).'),
+        all: z.boolean().optional().describe('Fetch every page from offset on instead of one page.'),
       },
       annotations: READ,
     },

tests/cloudFindings.test.js

@@ -72,6 +72,7 @@ describe('cloud findings client', () => {
       subscription_id: 'sub-1',
       min_days_unused: 30,
     }), tenant);
+    expect(fetchAppApi.mock.calls[0][2]).not.toHaveProperty('limit');
   });
 
   it('requires provider-specific scope and fetches detail by UID', async () => {
@@ -86,10 +87,12 @@ describe('cloud findings client', () => {
     }), tenant);
   });
 
-  it('uses the VM and container result endpoints without CSPM account fields', async () => {
+  it('uses the paged VM and container result endpoints without CSPM account fields', async () => {
     await runCloudFindings({ provider: 'gcp', kind: 'vm', scanId: 'vm-scan' });
-    expect(fetchAppApi).toHaveBeenNthCalledWith(1, '/cloud/gcp/vm-scanning/results', 'POST', expect.objectContaining({
+    expect(fetchAppApi).toHaveBeenNthCalledWith(1, '/cloud/gcp/vm-scanning/results/paginated', 'POST', expect.objectContaining({
       scan_id: 'vm-scan',
+      limit: 500,
+      offset: 0,
     }), tenant);
     expect(fetchAppApi.mock.calls[0][2]).not.toHaveProperty('project_id');
 
@@ -99,4 +102,19 @@ describe('cloud findings client', () => {
       uid: 'CVE-1',
     }), tenant);
   });
+
+  it('merges every container page with --all', async () => {
+    fetchAppApi.mockImplementation(async (_path, _method, body) => ({
+      status: 'completed',
+      total: 1100,
+      offset: body.offset,
+      findings: Array.from({ length: Math.min(500, 1100 - body.offset) }, (_, index) => ({ uid: `f${body.offset + index}` })),
+    }));
+
+    const result = await runCloudFindings({ provider: 'aws', kind: 'container', scanId: 'big', all: true });
+
+    expect(fetchAppApi.mock.calls.map((call) => call[2].offset)).toEqual([0, 500, 1000]);
+    expect(result.findings.map((finding) => finding.uid)).toEqual(Array.from({ length: 1100 }, (_, index) => `f${index}`));
+    expect(result).toMatchObject({ provider: 'aws', kind: 'container', total: 1100, status: 'completed' });
+  });
 });

tests/findingsPaginate.test.js

@@ -0,0 +1,49 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { fetchAppApi } = vi.hoisted(() => ({ fetchAppApi: vi.fn() }));
+
+vi.mock('../src/utils/fetchApi.js', () => ({ fetchAppApi }));
+
+const { fetchPaginated } = await import('../src/findings/paginate.js');
+
+const tenant = { organization: 'CodeAnt-AI' };
+const page = (body) => ({
+  total: 260,
+  limit: body.limit,
+  offset: body.offset,
+  items: Array.from({ length: Math.max(0, Math.min(body.limit, 260 - body.offset)) }, (_, index) => body.offset + index),
+});
+
+describe('paged findings fetch', () => {
+  beforeEach(() => {
+    fetchAppApi.mockReset();
+    fetchAppApi.mockImplementation(async (_path, _method, body) => page(body));
+  });
+
+  it('fetches one page of 500 by default', async () => {
+    const result = await fetchPaginated('/x/paginated', { org: 'o' }, tenant, 'items');
+
+    expect(fetchAppApi).toHaveBeenCalledTimes(1);
+    expect(fetchAppApi).toHaveBeenCalledWith('/x/paginated', 'POST', { org: 'o', limit: 500, offset: 0 }, tenant);
+    expect(result.items).toHaveLength(260);
+  });
+
+  it('merges every page from the starting offset with all', async () => {
+    const result = await fetchPaginated('/x/paginated', {}, tenant, 'items', { limit: 25, offset: 50, all: true });
+
+    expect(fetchAppApi.mock.calls.map((call) => call[2].offset)).toEqual(
+      Array.from({ length: 9 }, (_, index) => 50 + index * 25),
+    );
+    expect(result.items).toEqual(Array.from({ length: 210 }, (_, index) => 50 + index));
+    expect(result.total).toBe(260);
+  });
+
+  it.each([
+    [{ limit: 50 }, /--limit/],
+    [{ limit: 25, offset: 30 }, /--offset/],
+    [{ offset: -500 }, /--offset/],
+  ])('rejects %o before calling the API', async (options, message) => {
+    await expect(fetchPaginated('/x/paginated', {}, tenant, 'items', options)).rejects.toThrow(message);
+    expect(fetchAppApi).not.toHaveBeenCalled();
+  });
+});