Duplicate code, dismissed/FP markers, and issue overrides in scans (0.5.8)

The VS Code panel and agents read scan findings through these fetchers,
which dropped the backend's dismissed / false-positive markers for IaC
and dead code, had no duplicate-code type, and hid SCA dismissals.

- Add duplicate_code (fetchDuplicateCodeResults, scans results --types).
- Keep is_dismissed / reason / comment / is_false_positive when IaC and
  dead-code findings are flattened; normalized findings expose them as
  metadata.dismissed / metadata.false_positive.
- Add scans overrides, codeant_scans_overrides and the
  codeant-cli/scans/issue-overrides export for the new
  /extension/scans2/change-issue-details/get endpoint.
- scans dismissed accepts every analysis type (sast/anti_patterns map to
  the stored names) and keeps SCA / duplicate-code keys.
- SCA severity comes from ratings[0] instead of defaulting to medium.
- Extra dead-code paths drop the trailing result file name.
- Remove the debug dump of full fetch-results responses to stderr.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: pranavcodeant

changelog.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.5.8] - 02/10/2026
+- Added `duplicate_code` to `scans results` / `findings repo`
+- Dismissed and false-positive flags are kept on IaC and dead-code findings, and shown as `metadata.dismissed` / `metadata.false_positive`
+- Added `scans overrides` (and the `codeant_scans_overrides` MCP tool) for user false-positive, confidence, and severity overrides
+- `scans dismissed` accepts every analysis type and no longer drops SCA dismissals
+- SCA severity is read from the advisory rating instead of defaulting to medium
+- Extra dead-code file paths no longer end in the result file name
+- Removed a debug dump of full scan responses to stderr
+
 ## [0.5.7] - 28/09/2026
 - Login tokens are prefixed with `cli___` so CLI logins show up as CLI on the IDE users page
 

findings.md

@@ -49,9 +49,9 @@ codeant findings repo \
   --output codeant.sarif
 ```
 
-Supported repo types are `sast`, `sca`, `secrets`, `iac`, `dead_code`, `sbom`, `anti_patterns`, `docstring`, and `complex_functions`. Use `--types all` for all of them. Formats are `json`, `sarif`, `csv`, `md`, and `table`; JSON is the default.
+Supported repo types are `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, and `complex_functions`. Use `--types all` for all of them. Formats are `json`, `sarif`, `csv`, `md`, and `table`; JSON is the default.
 
-Use `--filter-dismissed` to exclude dismissed findings and `--no-false-positives` to exclude false positives. `--path`, `--check`, `--limit`, and `--offset` support agent-friendly filtering and pagination.
+Use `--filter-dismissed` to exclude dismissed findings and `--no-false-positives` to exclude false positives, including ones users marked in the app. Without those flags, such findings are returned with `metadata.dismissed` or `metadata.false_positive`. `--path`, `--check`, `--limit`, and `--offset` support agent-friendly filtering and pagination.
 
 ## Organization Hotlist findings
 

mcp.md

@@ -16,6 +16,7 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | `codeant_scans_get` | read | Severity/category summary for one scan. |
 | `codeant_scans_results` | read | Full findings (SAST, SCA, secrets, IaC, …) for one scan. |
 | `codeant_scans_dismissed` | read | Dismissed alerts for a repo. |
+| `codeant_scans_overrides` | read | User false-positive, confidence, and severity overrides for a repo. |
 | `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
 | `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |
 | `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos. |

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Code review CLI tool",
   "type": "module",
   "repository": {
@@ -36,6 +36,7 @@
     "./scans/fetch-results": "./src/scans/fetchScanResults.js",
     "./scans/fetch-advanced-results": "./src/scans/fetchAdvancedScanResults.js",
     "./scans/dismissed-alerts": "./src/scans/fetchDismissedAlerts.js",
+    "./scans/issue-overrides": "./src/scans/fetchIssueOverrides.js",
     "./hotlist": "./src/hotlist/client.js",
     "./findings/cloud": "./src/findings/cloud.js",
     "./findings/pentest": "./src/findings/pentest.js",

package.json

@@ -135,11 +135,12 @@ codeant scans results --repo <owner/repo> [options]
 | `--repo <repo>` | **(required)** Repository in `owner/repo` format |
 | `--scan <sha>` | Specific commit SHA to use |
 | `--branch <name>` | Resolve latest scan on this branch |
-| `--types <list>` | Comma-separated types: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all` (default: `all`) |
+| `--types <list>` | Comma-separated types: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all` (default: `all`) |
 | `--severity <list>` | Filter by severity (e.g. `critical,high`) |
 | `--path <glob>` | Filter by file path glob |
 | `--check <regex>` | Filter by check ID or name (regex) |
-| `--include-dismissed` | Include dismissed findings (excluded by default) |
+| `--filter-dismissed` | Exclude dismissed findings (included by default, marked `metadata.dismissed`) |
+| `--no-false-positives` | Exclude false positives, including ones users marked in the app (included by default, marked `metadata.false_positive`) |
 | `--format <fmt>` | Output format: `json`, `sarif`, `csv`, `md`, `table` (default: `json`) |
 | `--output <path>` | Write output to file instead of stdout |
 | `--fields <list>` | Project findings to a subset of fields (comma-separated) |
@@ -173,8 +174,8 @@ codeant scans results --repo acme/backend --format md
 # Output as SARIF to a file
 codeant scans results --repo acme/backend --format sarif --output results.sarif
 
-# Include dismissed findings
-codeant scans results --repo acme/backend --include-dismissed
+# Only open findings: drop dismissed findings and false positives
+codeant scans results --repo acme/backend --filter-dismissed --no-false-positives
 
 # Paginate through results
 codeant scans results --repo acme/backend --limit 50 --offset 100
@@ -206,7 +207,7 @@ codeant scans dismissed --repo <owner/repo> [options]
 | Option | Description |
 |--------|-------------|
 | `--repo <repo>` | **(required)** Repository in `owner/repo` format |
-| `--analysis-type <type>` | Analysis type: `security` or `secrets` (default: `security`) |
+| `--analysis-type <type>` | `security`, `secrets`, `sca`, `iac`, `antipatterns`, `docstring`, `complex_functions`, `dead_code`, or `duplicate_code` (default: `security`). Result-type names `sast` and `anti_patterns` are accepted too. |
 
 **Examples:**
 
@@ -220,6 +221,16 @@ codeant scans dismissed --repo acme/backend --analysis-type secrets
 
 ---
 
+### `scans overrides`
+
+List the per-finding overrides users set in the CodeAnt app: Mark/Unmark false positive (`security`, `iac`), secrets confidence (`secrets`), and Change Severity (`security`, `sca`). `scans results` already applies them.
+
+```bash
+codeant scans overrides --repo <owner/repo> [--analysis-type security|secrets|iac|sca]
+```
+
+---
+
 ### `scans start-scan`
 
 Trigger a new analysis run for a repository.

scans.md

@@ -1,16 +1,34 @@
 import { fetchDismissedAlerts } from '../../scans/fetchDismissedAlerts.js';
+import { fetchIssueOverrides } from '../../scans/fetchIssueOverrides.js';
 
-/**
- * codeant scans dismissed --repo <repo> [--analysis-type security|secrets]
- */
-export async function runDismissed({ repo, analysisType = 'security' } = {}) {
+// Result-type names (`scans results --types`) → the names dismissals and
+// overrides are stored under.
+const STORE_ANALYSIS_TYPES = {
+  sast: 'security',
+  security_issues: 'security',
+  anti_patterns: 'antipatterns',
+};
+
+export function storeAnalysisType(analysisType) {
+  return STORE_ANALYSIS_TYPES[analysisType] || analysisType;
+}
+
+function requireRepo(repo) {
   if (!repo) {
     const err = new Error('--repo is required');
     err.exitCode = 1;
     throw err;
   }
+}
+
+/**
+ * codeant scans dismissed --repo <repo> [--analysis-type <type>]
+ */
+export async function runDismissed({ repo, analysisType = 'security' } = {}) {
+  requireRepo(repo);
+  const type = storeAnalysisType(analysisType);
 
-  const result = await fetchDismissedAlerts(repo, analysisType);
+  const result = await fetchDismissedAlerts(repo, type);
   if (!result.success) {
     const err = new Error(result.error || 'Failed to fetch dismissed alerts');
     err.exitCode = 1;
@@ -19,8 +37,30 @@ export async function runDismissed({ repo, analysisType = 'security' } = {}) {
 
   return {
     repo,
-    analysis_type: analysisType,
+    analysis_type: type,
     total: result.dismissedAlerts.length,
     dismissed_alerts: result.dismissedAlerts,
   };
 }
+
+/**
+ * codeant scans overrides --repo <repo> [--analysis-type security|secrets|iac|sca]
+ */
+export async function runOverrides({ repo, analysisType = 'security' } = {}) {
+  requireRepo(repo);
+  const type = storeAnalysisType(analysisType);
+
+  const result = await fetchIssueOverrides(repo, type);
+  if (!result.success) {
+    const err = new Error(result.error || 'Failed to fetch issue overrides');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  return {
+    repo,
+    analysis_type: type,
+    total: Object.keys(result.overrides).length,
+    overrides: result.overrides,
+  };
+}

src/commands/scans/dismissed.js

@@ -3,7 +3,7 @@ import { runRepos } from './repos.js';
 import { runHistory } from './history.js';
 import { runGet } from './get.js';
 import { runResults } from './results.js';
-import { runDismissed } from './dismissed.js';
+import { runDismissed, runOverrides } from './dismissed.js';
 import { runStartScan } from './start-scan.js';
 import { setQuiet, setNoColor } from './lib/log.js';
 import { setNoColor as tableSetNoColor } from './formatters/table.js';
@@ -65,7 +65,7 @@ export default function registerScansCommands(program, { runCmd }) {
     .option('--branch <name>', 'Resolve latest scan on this branch')
     .option(
       '--types <list>',
-      'Comma-separated types: sast,sca,secrets,iac,dead_code,sbom,anti_patterns,docstring,complex_functions,all',
+      'Comma-separated types: sast,sca,secrets,iac,dead_code,duplicate_code,sbom,anti_patterns,docstring,complex_functions,all',
       'all'
     )
     .option('--severity <list>', 'Filter by severity (e.g. critical,high)')
@@ -117,11 +117,25 @@ export default function registerScansCommands(program, { runCmd }) {
     .command('dismissed')
     .description('List dismissed alerts for a repository')
     .requiredOption('--repo <repo>', 'Repository (owner/repo)')
-    .option('--analysis-type <type>', 'Analysis type: security|secrets (default: security)', 'security')
+    .option(
+      '--analysis-type <type>',
+      'Analysis type: security|secrets|sca|iac|antipatterns|docstring|complex_functions|dead_code|duplicate_code (default: security)',
+      'security'
+    )
     .action((opts) =>
       runCmd(() => runDismissed({ repo: opts.repo, analysisType: opts.analysisType }))
     );
 
+  // ── overrides ──────────────────────────────────────────────────────────────
+  scans
+    .command('overrides')
+    .description('List user overrides (false positive, confidence, severity) for a repository')
+    .requiredOption('--repo <repo>', 'Repository (owner/repo)')
+    .option('--analysis-type <type>', 'Analysis type: security|secrets|iac|sca (default: security)', 'security')
+    .action((opts) =>
+      runCmd(() => runOverrides({ repo: opts.repo, analysisType: opts.analysisType }))
+    );
+
   // ── start-scan ─────────────────────────────────────────────────────────────
   scans
     .command('start-scan')

src/commands/scans/index.js

@@ -10,6 +10,7 @@ import {
   fetchSecretsResults,
   fetchIacResults,
   fetchDeadCodeResults,
+  fetchDuplicateCodeResults,
 } from '../../../scans/fetchAdvancedScanResults.js';
 
 /**
@@ -26,6 +27,7 @@ export const CATEGORIES = {
   secrets:           { fetcher: fetchSecretsResults,          kind: 'secret' },
   iac:               { fetcher: fetchIacResults,              kind: 'config' },
   dead_code:         { fetcher: fetchDeadCodeResults,         kind: 'code' },
+  duplicate_code:    { fetcher: fetchDuplicateCodeResults,    kind: 'code' },
 };
 
 /**

src/commands/scans/lib/categories.js

@@ -87,8 +87,18 @@ export function normalizeIssue(issue, category) {
   } else if (category === 'sca') {
     if (issue.cvss_score !== undefined) metadata.cvss_score = issue.cvss_score;
     if (issue.fix_version) metadata.fix_version = issue.fix_version;
+  } else if (category === 'duplicate_code') {
+    if (issue.duplicate_group !== undefined) metadata.duplicate_group = issue.duplicate_group;
+    if (issue.duplicate_locations) metadata.duplicate_locations = issue.duplicate_locations;
   }
 
+  // Backend dispositions, present when dismissed / false positives are not filtered out.
+  if (issue.is_dismissed === true) {
+    metadata.dismissed = true;
+    if (issue.reason_for_dismiss) metadata.reason_for_dismiss = issue.reason_for_dismiss;
+  }
+  if (issue.is_false_positive === true) metadata.false_positive = true;
+
   const id = buildId(category, filePath, lineNumber, checkId, message);
 
   return {