codeant-cli 0.4.14 → 0.5.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 CodeAnt AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -236,6 +236,24 @@ node src/index.js secrets --last-commit
 node src/index.js secrets --all
 ```
 
+## MCP / Claude Connector
+
+This package also ships an MCP (Model Context Protocol) server that exposes CodeAnt's scan, review, and PR data as tools to Claude and other MCP clients. The same source tree is packaged as a Desktop Extension (`.mcpb`) for one-click install in Claude Desktop.
+
+See [mcp.md](mcp.md) for the tools listing, install paths (Claude Code CLI, Claude Desktop manual config, MCPB double-click), and bundling/submission instructions.
+
+## Privacy Policy
+
+Full policy: **https://codeant.ai/privacy**
+
+Summary of what this CLI / MCP server sends and stores:
+
+- **Data sent to CodeAnt servers.** Authentication tokens, repository metadata (org, repo, branch, PR identifiers), and — for local review and secrets scanning — the code snippets and diffs you explicitly ask CodeAnt to scan. Nothing is sent on its own; every call is in response to a command you run or a tool Claude invokes.
+- **Where it is stored.** On CodeAnt's infrastructure (https://api.codeant.ai or your self-hosted instance). Locally, the auth token is cached in `~/.codeant/config.json` on your machine.
+- **Third-party sharing.** None beyond CodeAnt's own infrastructure. CodeAnt does not sell or share your data with third parties for marketing.
+- **Retention.** Scan findings and PR data are retained per the CodeAnt account's retention policy (see the privacy URL above). Local config persists until you run `codeant logout` or delete `~/.codeant/config.json`.
+- **Contact.** support@codeant.ai
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.4.14",
+  "version": "0.5.2",
   "description": "Code review CLI tool",
   "type": "module",
   "bin": {
@@ -9,7 +9,8 @@
   "scripts": {
     "start": "node src/index.js",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "mcpb:build": "node scripts/build-mcpb.mjs"
   },
   "keywords": [
     "cli",
@@ -20,7 +21,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": ""
+    "url": "https://github.com/CodeAnt-AI/codeant-cli"
   },
   "main": "./src/reviewHeadless.js",
   "exports": {
@@ -40,6 +41,7 @@
   ],
   "dependencies": {
     "@gitbeaker/rest": "^43.8.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@octokit/rest": "^22.0.1",
     "azure-devops-node-api": "^15.1.2",
     "bitbucket": "^2.12.0",
@@ -49,7 +51,9 @@
     "open": "^10.1.0",
     "posthog-node": "^5.28.5",
     "react": "^18.3.1",
-    "smol-toml": "^1.6.1"
+    "smol-toml": "^1.6.1",
+    "undici": "^6.26.0",
+    "zod": "^3.25.76"
   },
   "devDependencies": {
     "vitest": "^1.6.1"

package/src/commands/login.js

@@ -1,7 +1,7 @@
 import React, { useState, useEffect } from 'react';
 import { Text, Box, useApp } from 'ink';
 import { getConfigValue, setConfigValue } from '../utils/config.js';
-import { getBaseUrl } from '../utils/baseUrl.js';
+import { getBaseUrl, getDashboardUrl } from '../utils/baseUrl.js';
 import { randomUUID } from 'crypto';
 
 const POLL_INTERVAL = 10000; // 10 seconds
@@ -24,49 +24,55 @@ export default function Login() {
 
     const token = randomUUID();
     const baseUrl = getBaseUrl();
-    const loginUrl = `https://app.codeant.ai?ideLoginToken=${token}`;
-    setLoginUrl(loginUrl);
     const pollUrl = `${baseUrl}/extension/login/status?apiKey=${token}`;
 
-    // Open browser
-    import('open').then(({ default: open }) => {
-      open(loginUrl);
-      setStatus('waiting');
-    }).catch(() => {
-      // Fallback: just show the URL
-      console.log(`\nOpen this URL in your browser:\n${loginUrl}\n`);
-      setStatus('waiting');
-    });
-
-    // Poll for login status
+    let intervalId;
     let timeoutId;
-    const intervalId = setInterval(async () => {
-      try {
-        const response = await fetch(pollUrl);
-        const data = await response.json();
 
-        if (data.status === 'yes') {
-          clearInterval(intervalId);
-          clearTimeout(timeoutId);
-
-          // Save the API key
-          setConfigValue('apiKeyV2', token);
-
-          setStatus('success');
-          setTimeout(() => exit(), 100);
+    (async () => {
+      const dashboardUrl = await getDashboardUrl();
+      const loginUrl = `${dashboardUrl}?ideLoginToken=${token}`;
+      setLoginUrl(loginUrl);
+
+      // Open browser
+      import('open').then(({ default: open }) => {
+        open(loginUrl);
+        setStatus('waiting');
+      }).catch(() => {
+        // Fallback: just show the URL
+        console.log(`\nOpen this URL in your browser:\n${loginUrl}\n`);
+        setStatus('waiting');
+      });
+
+      // Poll for login status
+      intervalId = setInterval(async () => {
+        try {
+          const response = await fetch(pollUrl);
+          const data = await response.json();
+
+          if (data.status === 'yes') {
+            clearInterval(intervalId);
+            clearTimeout(timeoutId);
+
+            // Save the API key
+            setConfigValue('apiKeyV2', token);
+
+            setStatus('success');
+            setTimeout(() => exit(), 100);
+          }
+        } catch (err) {
+          // Silently continue polling
         }
-      } catch (err) {
-        // Silently continue polling
-      }
-    }, POLL_INTERVAL);
-
-    // Timeout after 10 minutes
-    timeoutId = setTimeout(() => {
-      clearInterval(intervalId);
-      setError('Login timed out. Please try again.');
-      setStatus('error');
-      setTimeout(() => exit(new Error('Login timed out')), 100);
-    }, TIMEOUT);
+      }, POLL_INTERVAL);
+
+      // Timeout after 10 minutes
+      timeoutId = setTimeout(() => {
+        clearInterval(intervalId);
+        setError('Login timed out. Please try again.');
+        setStatus('error');
+        setTimeout(() => exit(new Error('Login timed out')), 100);
+      }, TIMEOUT);
+    })();
 
     // Cleanup
     return () => {

package/src/components/ScanCenter.js

@@ -190,7 +190,7 @@ export default function ScanCenter({ filterDismissed = false, includeFalsePositi
 
   // ── Step 3: repo selected → fetch scan history ──
   const handleSelectRepo = (item) =>
-    _handleSelectRepo({ STEPS, item, setSelectedRepo, setStep, setLoadingMsg, setError, setScanHistory });
+    _handleSelectRepo({ STEPS, item, selectedConnection, setSelectedRepo, setStep, setLoadingMsg, setError, setScanHistory });
 
   // ── Step 4: scan selected → show result type menu ──
   const handleSelectScan = (item) =>

package/src/index.js

@@ -397,6 +397,15 @@ program
   // ─── Settings commands ───
   registerSettingsCommands(program, { runCmd });
 
+  // ─── MCP server (for Claude Code plugin and other MCP clients) ───
+  program
+    .command('mcp')
+    .description('Run the CodeAnt MCP server over stdio (used by Claude Code plugin)')
+    .action(async () => {
+      const { startMcpServer } = await import('./mcp/server.js');
+      await startMcpServer();
+    });
+
   // ─── Telemetry control ───
   program
     .command('set-telemetry <enabled>')

package/src/mcp/server.js

@@ -0,0 +1,489 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import { createRequire } from 'module';
+
+import { runOrgs } from '../commands/scans/orgs.js';
+import { runRepos } from '../commands/scans/repos.js';
+import { runHistory } from '../commands/scans/history.js';
+import { runGet } from '../commands/scans/get.js';
+import { runResults } from '../commands/scans/results.js';
+import { runDismissed } from '../commands/scans/dismissed.js';
+import { runStartScan } from '../commands/scans/start-scan.js';
+import { runReviewHeadless } from '../reviewHeadless.js';
+import * as scm from '../scm/index.js';
+import { isAlreadyLoggedIn, runLoginFlow } from '../utils/loginFlow.js';
+import { getConfigValue, setConfigValue } from '../utils/config.js';
+
+const require = createRequire(import.meta.url);
+const pkg = require('../../package.json');
+
+const READ = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true };
+const WRITE_NON_DESTRUCTIVE = { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true };
+
+// Write-side tools are gated behind CODEANT_READ_ONLY. Default = read-only.
+function isReadOnly() {
+  const v = process.env.CODEANT_READ_ONLY;
+  if (v === undefined) return true;
+  return v !== '0' && v.toLowerCase() !== 'false';
+}
+
+function ok(value) {
+  return { content: [{ type: 'text', text: JSON.stringify(value, null, 2) }] };
+}
+
+function fail(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return {
+    isError: true,
+    content: [{ type: 'text', text: JSON.stringify({ error: message }, null, 2) }],
+  };
+}
+
+function resolveRepoOpts(input) {
+  const remote = input.remote || scm.detectRemote();
+  const name = input.name || scm.detectRepoName();
+  const defaultBranch = input.defaultBranch || scm.detectDefaultBranch();
+  if (!remote) throw new Error('Could not detect remote. Pass `remote` (github|gitlab|bitbucket|azure).');
+  if (!name) throw new Error('Could not detect repo name. Pass `name` (owner/repo).');
+  return { ...input, remote, name, defaultBranch };
+}
+
+// Capture stdout from a function that writes JSON to stdout (used for `scans results` and `scans start-scan`).
+async function captureStdout(fn) {
+  const chunks = [];
+  const origWrite = process.stdout.write.bind(process.stdout);
+  process.stdout.write = (chunk) => {
+    chunks.push(typeof chunk === 'string' ? chunk : chunk.toString('utf8'));
+    return true;
+  };
+  try {
+    await fn();
+  } finally {
+    process.stdout.write = origWrite;
+  }
+  return chunks.join('');
+}
+
+async function ensureAuthenticated() {
+  const envToken = process.env.CODEANT_API_TOKEN;
+  if (envToken && envToken.trim()) return;
+  if (isAlreadyLoggedIn()) {
+    process.env.CODEANT_API_TOKEN = getConfigValue('apiKeyV2');
+    return;
+  }
+
+  console.error('[codeant-mcp] No API token configured. Call the codeant_login tool to sign in, or set CODEANT_API_TOKEN.');
+}
+
+export async function startMcpServer() {
+  await ensureAuthenticated();
+
+  const server = new McpServer({ name: 'codeant', version: pkg.version });
+  const readOnly = isReadOnly();
+
+  // ─── Scans: discovery ────────────────────────────────────────────────────
+  server.registerTool(
+    'codeant_scans_orgs',
+    {
+      title: 'List CodeAnt organizations',
+      description: 'List the CodeAnt organizations the current user is authenticated to. Use this first when the user has not specified an org.',
+      inputSchema: {},
+      annotations: READ,
+    },
+    async () => {
+      try { return ok(await runOrgs()); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_scans_repos',
+    {
+      title: 'List repositories in a CodeAnt org',
+      description: 'List repositories connected to CodeAnt for a given organization. Use this to enumerate repos before fanning out org-wide queries (e.g. "secrets across all repos"). If `org` is omitted and the user has exactly one org, it is auto-picked.',
+      inputSchema: {
+        org: z.string().optional().describe('Organization name. Optional when only one org is authenticated.'),
+      },
+      annotations: READ,
+    },
+    async ({ org }) => {
+      try { return ok(await runRepos({ org })); } catch (err) { return fail(err); }
+    }
+  );
+
+  // ─── Scans: history + metadata ───────────────────────────────────────────
+  server.registerTool(
+    'codeant_scans_history',
+    {
+      title: 'List scan history for a repo',
+      description: 'Show recent scan runs for a single repository. Use this to find a scan ID/commit SHA to drill into, or to answer "when did this repo last get scanned".',
+      inputSchema: {
+        repo: z.string().describe('Repository in owner/repo form.'),
+        branch: z.string().optional().describe('Filter by branch name.'),
+        since: z.string().optional().describe('ISO 8601 date; only return scans newer than this.'),
+        limit: z.number().int().positive().max(100).optional().describe('Max scans returned (default 20).'),
+      },
+      annotations: READ,
+    },
+    async ({ repo, branch, since, limit }) => {
+      try { return ok(await runHistory({ repo, branch, since, limit: limit ?? 20 })); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_scans_get',
+    {
+      title: 'Get scan metadata summary',
+      description: 'Get summary metadata for a single scan (severity + category counts only — no findings). Use this to size up a scan before pulling full results.',
+      inputSchema: {
+        repo: z.string().describe('Repository in owner/repo form.'),
+        scan: z.string().optional().describe('Specific commit SHA. Either `scan` or `branch` should be provided.'),
+        branch: z.string().optional().describe('Resolve the latest scan on this branch.'),
+        types: z.string().optional().describe('Comma-separated scan types (default "all"). e.g. "sast,secrets".'),
+      },
+      annotations: READ,
+    },
+    async ({ repo, scan, branch, types }) => {
+      try { return ok(await runGet({ repo, scan, branch, types: types ?? 'all' })); } catch (err) { return fail(err); }
+    }
+  );
+
+  // ─── Scans: findings ─────────────────────────────────────────────────────
+  server.registerTool(
+    'codeant_scans_results',
+    {
+      title: 'Fetch scan findings',
+      description: 'Fetch full findings (SAST, SCA, secrets, IaC, dead code, anti-patterns, etc.) for a single scan on a single repository. Returns the raw findings as JSON. For org-wide queries, call `codeant_scans_repos` first and fan out per-repo.',
+      inputSchema: {
+        repo: z.string().describe('Repository in owner/repo form.'),
+        scan: z.string().optional().describe('Specific commit SHA.'),
+        branch: z.string().optional().describe('Resolve the latest scan on this branch.'),
+        types: z.string().optional().describe('Comma-separated types: sast,sca,secrets,iac,dead_code,sbom,anti_patterns,docstring,complex_functions,all (default "all").'),
+        severity: z.string().optional().describe('Comma-separated severities (e.g. "critical,high").'),
+        path: z.string().optional().describe('File path glob filter.'),
+        check: z.string().optional().describe('Filter by check ID or name (regex).'),
+        filterDismissed: z.boolean().optional().describe('Exclude dismissed findings (default false).'),
+        includeFalsePositives: z.boolean().optional().describe('Include false positives (default true).'),
+        fields: z.string().optional().describe('Project findings to a subset of fields (comma-separated).'),
+        limit: z.number().int().positive().max(500).optional().describe('Max findings per page (default 100).'),
+        offset: z.number().int().nonnegative().optional().describe('Pagination offset (default 0).'),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try {
+        const text = await captureStdout(() =>
+          runResults({
+            repo: input.repo,
+            scan: input.scan,
+            branch: input.branch,
+            types: input.types ?? 'all',
+            severity: input.severity,
+            path: input.path,
+            check: input.check,
+            filterDismissed: input.filterDismissed ?? false,
+            includeFalsePositives: input.includeFalsePositives ?? true,
+            format: 'json',
+            output: undefined,
+            fields: input.fields,
+            limit: input.limit ?? 100,
+            offset: input.offset ?? 0,
+            failFast: false,
+          })
+        );
+        // runResults already emits JSON; pass it through unparsed to preserve shape.
+        return { content: [{ type: 'text', text: text || '{}' }] };
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+
+  server.registerTool(
+    'codeant_scans_dismissed',
+    {
+      title: 'List dismissed alerts',
+      description: 'List dismissed alerts (false positives, accepted risk, etc.) for a repository. Useful when triaging to avoid re-surfacing already-handled findings.',
+      inputSchema: {
+        repo: z.string().describe('Repository in owner/repo form.'),
+        analysisType: z.enum(['security', 'secrets']).optional().describe('Analysis type (default "security").'),
+      },
+      annotations: READ,
+    },
+    async ({ repo, analysisType }) => {
+      try { return ok(await runDismissed({ repo, analysisType: analysisType ?? 'security' })); } catch (err) { return fail(err); }
+    }
+  );
+
+  // ─── Pull requests (SCM, read-only) ──────────────────────────────────────
+  server.registerTool(
+    'codeant_pr_list',
+    {
+      title: 'List pull requests',
+      description: 'List pull requests / merge requests on the current repo (auto-detected from git remote unless `name`+`remote` are provided).',
+      inputSchema: {
+        name: z.string().optional().describe('Repository in owner/repo form. Auto-detected if omitted.'),
+        remote: z.enum(['github', 'gitlab', 'bitbucket', 'azure']).optional().describe('Auto-detected if omitted.'),
+        defaultBranch: z.string().optional(),
+        sourceBranch: z.string().optional(),
+        author: z.string().optional().describe('Filter by author login (fuzzy).'),
+        state: z.enum(['open', 'closed']).optional().describe('Default "open".'),
+        limit: z.number().int().positive().max(100).optional(),
+        offset: z.number().int().nonnegative().optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try {
+        const opts = resolveRepoOpts(input);
+        return ok(
+          await scm.listPullRequests({
+            name: opts.name,
+            remote: opts.remote,
+            defaultBranch: opts.defaultBranch,
+            sourceBranch: opts.sourceBranch,
+            authorLogin: opts.author,
+            state: opts.state ?? 'open',
+            limit: opts.limit ?? 20,
+            offset: opts.offset ?? 0,
+          })
+        );
+      } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_pr_get',
+    {
+      title: 'Get pull request details',
+      description: 'Fetch detailed information for a single PR/MR including review analysis.',
+      inputSchema: {
+        prNumber: z.number().int().positive(),
+        name: z.string().optional(),
+        remote: z.enum(['github', 'gitlab', 'bitbucket', 'azure']).optional(),
+        defaultBranch: z.string().optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try {
+        const opts = resolveRepoOpts(input);
+        return ok(
+          await scm.getPullRequest({
+            name: opts.name,
+            remote: opts.remote,
+            defaultBranch: opts.defaultBranch,
+            prNumber: input.prNumber,
+          })
+        );
+      } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_pr_comments',
+    {
+      title: 'List PR comments',
+      description: 'List comments on a PR/MR with optional filters (CodeAnt-authored only, resolved/unresolved, date range).',
+      inputSchema: {
+        prNumber: z.number().int().positive(),
+        name: z.string().optional(),
+        remote: z.enum(['github', 'gitlab', 'bitbucket', 'azure']).optional(),
+        defaultBranch: z.string().optional(),
+        codeantGenerated: z.boolean().optional().describe('Only return comments authored by CodeAnt.'),
+        addressed: z.boolean().optional().describe('Filter by addressed/resolved status.'),
+        createdAfter: z.string().optional().describe('ISO 8601.'),
+        createdBefore: z.string().optional().describe('ISO 8601.'),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try {
+        const opts = resolveRepoOpts(input);
+        return ok(
+          await scm.listPullRequestComments({
+            name: opts.name,
+            remote: opts.remote,
+            defaultBranch: opts.defaultBranch,
+            prNumber: input.prNumber,
+            codeantGenerated: input.codeantGenerated,
+            addressed: input.addressed,
+            createdAfter: input.createdAfter,
+            createdBefore: input.createdBefore,
+          })
+        );
+      } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_comments_search',
+    {
+      title: 'Search CodeAnt review comments',
+      description: 'Search across CodeAnt review comments by free-text query. Returns matching comments with repo, PR, and file context.',
+      inputSchema: {
+        query: z.string(),
+        name: z.string().optional(),
+        remote: z.enum(['github', 'gitlab', 'bitbucket', 'azure']).optional(),
+        limit: z.number().int().positive().max(50).optional(),
+        includeAddressed: z.boolean().optional(),
+        createdAfter: z.string().optional().describe('ISO 8601.'),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try {
+        const opts = resolveRepoOpts(input);
+        return ok(
+          await scm.searchComments({
+            name: opts.name,
+            remote: opts.remote,
+            query: input.query,
+            limit: input.limit ?? 10,
+            includeAddressed: input.includeAddressed ?? false,
+            createdAfter: input.createdAfter,
+          })
+        );
+      } catch (err) { return fail(err); }
+    }
+  );
+
+  // ─── Local review (read-only — does not modify files) ────────────────────
+  server.registerTool(
+    'codeant_review_local',
+    {
+      title: 'Review local working-copy changes',
+      description: 'Run a CodeAnt AI review on local working-copy changes and return the findings as JSON. Does not modify files — pair with editor tools to apply fixes. Use this for "review my changes" / "check my staged files" prompts.',
+      inputSchema: {
+        scope: z
+          .enum(['all', 'uncommitted', 'staged-only', 'committed', 'last-commit', 'last-n-commits', 'base-branch', 'base-commit'])
+          .optional()
+          .describe('Review scope. Default "uncommitted".'),
+        lastNCommits: z.number().int().positive().max(5).optional(),
+        baseBranch: z.string().optional(),
+        baseCommit: z.string().optional(),
+        include: z.array(z.string()).optional().describe('Glob patterns to include.'),
+        exclude: z.array(z.string()).optional().describe('Glob patterns to exclude.'),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try {
+        const result = await runReviewHeadless({
+          workspacePath: process.cwd(),
+          scanType: input.scope ?? 'uncommitted',
+          lastNCommits: input.lastNCommits ?? 1,
+          include: input.include ?? [],
+          exclude: input.exclude ?? [],
+          baseBranch: input.baseBranch ?? null,
+          baseCommit: input.baseCommit ?? null,
+          onProgress: () => {},
+          onFilesReady: () => {},
+        });
+        return ok(result);
+      } catch (err) { return fail(err); }
+    }
+  );
+
+  // ─── Auth (always registered — login is needed even in read-only mode) ───
+  server.registerTool(
+    'codeant_login',
+    {
+      title: 'Sign in to CodeAnt AI',
+      description: 'Opens the configured CodeAnt dashboard in the user\'s browser and waits up to 10 minutes for them to complete sign-in. Tell the user to check their browser and finish the flow there. On success the API token is saved to ~/.codeant/config.json (apiKeyV2) and set on the running MCP process, so subsequent tool calls are authenticated without restart. Returns { alreadyLoggedIn: true } immediately if a token is already configured, unless `force` is true.',
+      inputSchema: {
+        force: z.boolean().optional().describe('Re-authenticate even if a token is already configured. Default false.'),
+      },
+      annotations: { ...WRITE_NON_DESTRUCTIVE, idempotentHint: true },
+    },
+    async ({ force }) => {
+      try {
+        const envToken = process.env.CODEANT_API_TOKEN;
+        if (!force && ((envToken && envToken.trim()) || isAlreadyLoggedIn())) {
+          return ok({ alreadyLoggedIn: true });
+        }
+        const { token, loginUrl } = await runLoginFlow();
+        const masked = token ? `${token.slice(0, 8)}…` : null;
+        return ok({ status: 'success', loginUrl, token: masked });
+      } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_logout',
+    {
+      title: 'Sign out of CodeAnt AI',
+      description: 'Clears the saved API token from ~/.codeant/config.json and unsets CODEANT_API_TOKEN on the running MCP process. Returns { wasLoggedIn: false } immediately if no token was configured.',
+      inputSchema: {},
+      annotations: { ...WRITE_NON_DESTRUCTIVE, idempotentHint: true },
+    },
+    async () => {
+      try {
+        const wasLoggedIn = !!(process.env.CODEANT_API_TOKEN?.trim() || getConfigValue('apiKeyV2'));
+        setConfigValue('apiKeyV2', null);
+        delete process.env.CODEANT_API_TOKEN;
+        return ok({ wasLoggedIn, status: wasLoggedIn ? 'logged_out' : 'not_logged_in' });
+      } catch (err) { return fail(err); }
+    }
+  );
+
+  // ─── Write-side tools (gated behind CODEANT_READ_ONLY=0) ─────────────────
+  if (!readOnly) {
+    server.registerTool(
+      'codeant_scans_start',
+      {
+        title: 'Trigger a new scan',
+        description: 'Trigger a new scan run for a repository. WRITE OPERATION — only enabled when CODEANT_READ_ONLY=0.',
+        inputSchema: {
+          repo: z.string().optional().describe('owner/repo (auto-detected from git remote if omitted).'),
+          branch: z.string().optional(),
+          commit: z.string().optional(),
+          include: z.string().optional().describe('Comma-separated globs.'),
+          exclude: z.string().optional().describe('Comma-separated globs.'),
+        },
+        annotations: WRITE_NON_DESTRUCTIVE,
+      },
+      async (input) => {
+        try {
+          const text = await captureStdout(() => runStartScan(input));
+          return { content: [{ type: 'text', text: text || '{}' }] };
+        } catch (err) { return fail(err); }
+      }
+    );
+
+    server.registerTool(
+      'codeant_pr_resolve',
+      {
+        title: 'Resolve a PR conversation',
+        description: 'Resolve a conversation/comment thread on a PR. WRITE OPERATION — only enabled when CODEANT_READ_ONLY=0.',
+        inputSchema: {
+          prNumber: z.number().int().positive(),
+          name: z.string().optional(),
+          remote: z.enum(['github', 'gitlab', 'bitbucket', 'azure']).optional(),
+          commentId: z.number().int().optional(),
+          threadId: z.string().optional(),
+          discussionId: z.string().optional(),
+        },
+        annotations: { ...WRITE_NON_DESTRUCTIVE, idempotentHint: true },
+      },
+      async (input) => {
+        try {
+          const opts = resolveRepoOpts(input);
+          return ok(
+            await scm.resolveConversation({
+              name: opts.name,
+              remote: opts.remote,
+              prNumber: input.prNumber,
+              commentId: input.commentId,
+              threadId: input.threadId,
+              discussionId: input.discussionId,
+            })
+          );
+        } catch (err) { return fail(err); }
+      }
+    );
+  }
+
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}

package/src/reviewHeadless.js

@@ -125,27 +125,34 @@ export async function runReviewHeadless(options = {}) {
     // ── Split into per-file requests ────────────────────────────────────
     const perFileRequests = ReviewApiHelper.splitIntoPerFileRequests(requestBody);
 
-    onProgress(`Analyzing ${perFileRequests.length} file${perFileRequests.length !== 1 ? 's' : ''} in parallel...`);
+    const totalFiles = perFileRequests.reduce((n, r) => n + (r._filenames?.length || 0), 0);
+    onProgress(`Analyzing ${totalFiles} file${totalFiles !== 1 ? 's' : ''}...`);
 
-    // ── Per-file agent turn loops (parallel, fault-tolerant) ─────────────
+    // ── Per-batch agent turn loops (parallel, fault-tolerant) ────────────
+    // Each batch covers up to 5 files; backend reviews the multi-file diff
+    // in a single session (matches pragent's FileBatcher).
     const perFileResults = await Promise.all(
       perFileRequests.map(async (fileReq) => {
-        const filename = fileReq._filename;
-        delete fileReq._filename;
-
-        if (fileReq.file_contents?.[filename]) {
-          fileReq.file_content = fileReq.file_contents[filename];
-          fileReq.file_path = filename;
+        const filenames = fileReq._filenames || [];
+        delete fileReq._filenames;
+        const label = filenames.join(', ');
+
+        // Single-file batch: still pass file_content/file_path so backend can
+        // build head_file_str. Multi-file batches drop these (head_file_str
+        // becomes empty; agent gathers context via tools instead).
+        if (filenames.length === 1 && fileReq.file_contents?.[filenames[0]]) {
+          fileReq.file_content = fileReq.file_contents[filenames[0]];
+          fileReq.file_path = filenames[0];
         }
         delete fileReq.file_contents;
 
         try {
-          onProgress(`Reviewing ${filename}...`);
+          onProgress(`Reviewing ${label}...`);
           const result = await runTurnLoop(fileReq, gitRoot, false);
-          onProgress(`Done reviewing ${filename}`);
+          onProgress(`Done reviewing ${label}`);
           return result;
         } catch (err) {
-          console.error(`[error] Failed to review ${filename}: ${err.message}`);
+          console.error(`[error] Failed to review ${label}: ${err.message}`);
           return { finalMessage: null, finalOutput: null };
         }
       })
@@ -158,7 +165,12 @@ export async function runReviewHeadless(options = {}) {
       output: perFileResults[i].finalOutput,
     })).filter(r => r.output?.code_suggestions?.length > 0);
 
-    onProgress(`${perFileWithSuggestions.length} file(s) have suggestions, running reflector...`);
+    const filesWithSuggestions = new Set(
+      perFileWithSuggestions.flatMap(r =>
+        (r.output?.code_suggestions || []).map(s => (s.relevant_file || '').trim()).filter(Boolean)
+      )
+    ).size;
+    onProgress(`${filesWithSuggestions} file${filesWithSuggestions !== 1 ? 's' : ''} have suggestions, running reflector...`);
 
     // ── Per-file reflector loops (parallel, fault-tolerant) ──────────────
     const reflectorResults = await Promise.all(
@@ -180,15 +192,34 @@ export async function runReviewHeadless(options = {}) {
       })
     );
 
-    // ── Parse results ───────────────────────────────────────────────────
-    const issues = reflectorResults.flatMap(r =>
-      (r.finalOutput?.code_suggestions || []).map((issue) => ({
+    // ── Parse results, carrying generator labels through reflector ──────
+    // Pragent's rejector schema drops `label`; preserve it by matching the
+    // reflector's per-issue (file, start_line) back to the generator's output.
+    const issues = reflectorResults.flatMap((r, i) => {
+      const genSuggestions = perFileWithSuggestions[i]?.output?.code_suggestions || [];
+      const norm = (v) => (typeof v === 'string' ? v.trim() : v);
+      const labelFor = (issue) => {
+        if (norm(issue.label)) return norm(issue.label);
+        // Match by summary (pragent's primary strategy): rejector's
+        // suggestion_summary (renamed to issue_content server-side) is
+        // "Repeated from the input" — i.e. the generator's one_sentence_summary.
+        const summary = norm(issue.issue_content);
+        if (summary) {
+          const exact = genSuggestions.find(g => norm(g.one_sentence_summary) === summary);
+          if (norm(exact?.label)) return norm(exact.label);
+        }
+        // Fallback: first generator suggestion in the same file with a label.
+        const file = norm(issue.relevant_file);
+        const sameFile = genSuggestions.find(g => norm(g.relevant_file) === file && norm(g.label));
+        return norm(sameFile?.label) || 'Code Quality';
+      };
+      return (r.finalOutput?.code_suggestions || []).map((issue) => ({
         issue_content: issue.issue_content || '',
         relevant_file: issue.relevant_file || 'Unknown',
         start_line: issue.start_line || 0,
-        label: issue.label || 'Code Quality',
-      }))
-    );
+        label: labelFor(issue),
+      }));
+    });
 
     const labelCounts = {};
     for (const i of issues) { labelCounts[i.label] = (labelCounts[i.label] || 0) + 1; }

package/src/rules/secrets.toml

@@ -4071,16 +4071,6 @@ regex = '''(?i)\b(phx_[a-zA-Z0-9_\-]{47})(?:\\?['"\x60]|[\s;]|\\[nr]|$)'''
 entropy = 3
 keywords = ["phx_"]
 
-# ──────────────────────────────────────────────────────────────────────────────
-# posthog-project-api-key
-# ──────────────────────────────────────────────────────────────────────────────
-[[rules]]
-id = "posthog-project-api-key"
-description = "Detected a PostHog Project API Key, which may expose product analytics data and event tracking to unauthorized access."
-regex = '''(?i)\b(phc_[a-zA-Z0-9_\-]{43})(?:\\?['"\x60]|[\s;]|\\[nr]|$)'''
-entropy = 3
-keywords = ["phc_"]
-
 # ──────────────────────────────────────────────────────────────────────────────
 # postman-api-token
 # ──────────────────────────────────────────────────────────────────────────────

package/src/scanCenter/handleSelectRepo.js

@@ -1,9 +1,15 @@
 import { getScanHistory } from '../scans/getScanHistory.js';
 
-export async function handleSelectRepo({ STEPS, item, setSelectedRepo, setStep, setLoadingMsg, setError, setScanHistory }) {
+export async function handleSelectRepo({ STEPS, item, selectedConnection, setSelectedRepo, setStep, setLoadingMsg, setError, setScanHistory }) {
   setSelectedRepo(item.value);
   setStep(STEPS.LOADING);
-  const repoFullName = item.value.full_name || item.value.name;
+  const orgName = selectedConnection?.organizationName;
+  const repoName = item.value.name;
+  const repoFullName = item.value.full_name || (orgName && repoName ? `${orgName}/${repoName}` : repoName);
+  if (!repoFullName || !repoFullName.includes('/')) {
+    setError(`Cannot resolve repository in org/repo form (got "${repoFullName}")`, STEPS.SELECT_REPO);
+    return;
+  }
   setLoadingMsg(`Loading scan history for ${repoFullName}…`);
   const res = await getScanHistory(repoFullName);
   if (!res.success) {

package/src/scans/fetchScanResults.js

@@ -70,6 +70,7 @@ export async function fetchScanResults(repo, commitId, resultType, opts = {}) {
       filter_dismissed: filterDismissed,
       include_false_positives: includeFalsePositives,
     });
+    console.error("dropship: ", JSON.stringify(response, null, 2));
 
     if (!response) {
       return { success: false, error: 'Failed to connect to CodeAnt server' };

package/src/tools/bulkReadTool.js

@@ -0,0 +1,20 @@
+import { readTool } from './readTool.js';
+
+const MAX_FILES = 10;
+
+export async function bulkReadTool(args, cwd) {
+  const files = Array.isArray(args.files) ? args.files.slice(0, MAX_FILES) : [];
+  if (!files.length) return 'Error: BulkRead requires a non-empty `files` array';
+
+  const parts = await Promise.all(
+    files.map(async (f) => {
+      try {
+        const content = await readTool(f, cwd);
+        return `===== ${f.file_path} =====\n${content}`;
+      } catch (err) {
+        return `===== ${f.file_path} =====\nError: ${err.message}`;
+      }
+    })
+  );
+  return parts.join('\n\n');
+}

package/src/tools/executeTool.js

@@ -2,28 +2,41 @@ import { readTool } from './readTool.js';
 import { globTool } from './globTool.js';
 import { grepTool } from './grepTool.js';
 import { lsTool } from './lsTool.js';
+import { bulkReadTool } from './bulkReadTool.js';
 
-export async function executeTool(toolCall, cwd) {
-  const { name, args } = toolCall;
-
-  try {
-    if (name === 'Read') {
-      return await readTool(args, cwd);
-    }
+// Pragent prompts instruct the model to use absolute paths rooted at /workspace.
+// The CLI works relative to the user's cwd, so strip that prefix (and any other
+// leading slash) before handing off to the tool implementations.
+function stripWorkspace(p) {
+  if (typeof p !== 'string') return p;
+  return p.replace(/^\/workspace\/?/, '').replace(/^\/+/, '');
+}
 
-    if (name === 'Glob') {
-      return await globTool(args, cwd);
-    }
+function normalizeArgs(args) {
+  if (!args || typeof args !== 'object') return args;
+  const out = { ...args };
+  if ('file_path' in out) out.file_path = stripWorkspace(out.file_path);
+  if ('path' in out) out.path = stripWorkspace(out.path);
+  if (Array.isArray(out.files)) {
+    out.files = out.files.map((f) =>
+      f && typeof f === 'object' ? { ...f, file_path: stripWorkspace(f.file_path) } : f
+    );
+  }
+  return out;
+}
 
-    if (name === 'Grep') {
-      return await grepTool(args, cwd);
-    }
+export async function executeTool(toolCall, cwd) {
+  const { name } = toolCall;
+  const args = normalizeArgs(toolCall.args);
 
-    if (name === 'LS') {
-      return await lsTool(args, cwd);
-    }
+  try {
+    if (name === 'Read') return await readTool(args, cwd);
+    if (name === 'Glob') return await globTool(args, cwd);
+    if (name === 'Grep') return await grepTool(args, cwd);
+    if (name === 'LS') return await lsTool(args, cwd);
+    if (name === 'BulkRead') return await bulkReadTool(args, cwd);
 
-    // Bash tool intentionally removed to prevent arbitrary command execution
+    // Bash intentionally not supported — see Extension/AgenticReview/tools.py.
     return `Unknown tool: ${name}`;
   } catch (err) {
     return `Error: ${err.message}`;

package/src/tools/globTool.js

@@ -1,8 +1,10 @@
 import path from 'path';
+import { assertInsideCwd } from './pathUtils.js';
 
 export async function globTool(args, cwd) {
   const { globSync } = await import('glob');
   const pattern = path.resolve(cwd, args.pattern);
+  assertInsideCwd(pattern.replace(/[*?{[\\].*$/, '') || cwd, cwd);
   const matches = globSync(pattern);
   if (!matches.length) return 'No files found';
   return matches.map(m => path.relative(cwd, m)).join('\n');

package/src/tools/grepTool.js

@@ -1,8 +1,10 @@
 import { spawn } from 'child_process';
 import path from 'path';
+import { assertInsideCwd } from './pathUtils.js';
 
 export async function grepTool(args, cwd) {
   const target = args.path ? path.resolve(cwd, args.path) : cwd;
+  assertInsideCwd(target, cwd);
   const result = await new Promise((resolve) => {
     const proc = spawn('grep', ['-rn', args.pattern, target], {
       cwd,

package/src/tools/lsTool.js

@@ -1,7 +1,9 @@
 import fs from 'fs';
 import path from 'path';
+import { assertInsideCwd } from './pathUtils.js';
 
 export async function lsTool(args, cwd) {
   const dirPath = args.path ? path.resolve(cwd, args.path) : cwd;
+  assertInsideCwd(dirPath, cwd);
   return fs.readdirSync(dirPath).sort().join('\n');
 }

package/src/tools/pathUtils.js

@@ -0,0 +1,9 @@
+import path from 'path';
+
+export function assertInsideCwd(resolved, cwd) {
+  const base = path.resolve(cwd);
+  const target = path.resolve(resolved);
+  if (target !== base && !target.startsWith(base + path.sep)) {
+    throw new Error(`Access denied: path is outside the working directory`);
+  }
+}

package/src/tools/readTool.js

@@ -1,8 +1,10 @@
 import fs from 'fs';
 import path from 'path';
+import { assertInsideCwd } from './pathUtils.js';
 
 export async function readTool(args, cwd) {
   const filePath = path.resolve(cwd, args.file_path);
+  assertInsideCwd(filePath, cwd);
   const content = await fs.promises.readFile(filePath, 'utf8');
   const lines = content.split('\n');
   const offset = args.offset || 1;

package/src/utils/baseUrl.js

@@ -1,5 +1,6 @@
 import { getConfigValue } from './config.js';
 
+//
 const NEW_BASE_URL = 'https://service.codeant.ai';
 
 const getBaseUrl = () => {
@@ -8,4 +9,15 @@ const getBaseUrl = () => {
   return url;
 };
 
-export { getBaseUrl };
+const getDashboardUrl = async () => {
+  try {
+    const response = await fetch(`${getBaseUrl()}/extension/get/dashboard`);
+    // console.log('Fetching dashboard URL from:', `${getBaseUrl()}/extension/get/dashboard`);
+    const data = await response.json();
+    return data.dashboard_url || 'https://app.codeant.ai';
+  } catch {
+    return 'https://app.codeant.ai';
+  }
+};
+
+export { getBaseUrl, getDashboardUrl };

package/src/utils/fetchApi.js

@@ -1,6 +1,28 @@
+import { Agent, setGlobalDispatcher } from 'undici';
 import { getConfigValue } from './config.js';
 import { getBaseUrl } from './baseUrl.js';
 
+// Undici's default TCP connect timeout (10s) is too short for cold-start
+// Lambda / API-Gateway TLS handshakes under burst load (the headless review
+// fan-outs 8 requests at once). Bump to 60s globally + retry on transient
+// network errors so cold starts don't break the run.
+setGlobalDispatcher(
+  new Agent({
+    connect: { timeout: 60_000 },
+    connections: 32,
+  })
+);
+
+const RETRYABLE_CAUSES = new Set([
+  'UND_ERR_CONNECT_TIMEOUT',
+  'UND_ERR_SOCKET',
+  'ECONNRESET',
+  'ETIMEDOUT',
+  'ENOTFOUND',
+]);
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
 const fetchApi = async (endpoint, method = 'GET', body = null) => {
   const url = endpoint.startsWith('http') ? endpoint : `${getBaseUrl()}${endpoint}`;
 
@@ -21,25 +43,39 @@ const fetchApi = async (endpoint, method = 'GET', body = null) => {
     options.body = JSON.stringify(body);
   }
 
-  try {
-    const response = await fetch(url, options);
-    console.error('API Response Status:', response.status);
+  // Retry transient network/cold-start failures up to 2 times.
+  const MAX_ATTEMPTS = 3;
+  let lastErr;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      const response = await fetch(url, options);
+      // console.error('API Response Status:', response.status);
 
-    if (response.status === 403) {
-      throw new Error('Access denied (403). Please run `codeant logout` and then `codeant login` to re-authenticate.');
-    }
+      if (response.status === 403) {
+        throw new Error('Access denied (403). Please run `codeant logout` and then `codeant login` to re-authenticate.');
+      }
 
-    const data = await response.json();
+      const data = await response.json();
 
-    if (!response.ok) {
-      throw new Error(data.message || `HTTP error ${response.status}`);
-    }
+      if (!response.ok) {
+        throw new Error(data.message || `HTTP error ${response.status}`);
+      }
 
-    return data;
-  } catch (err) {
-    console.error(`API Error: ${err.message}`);
-    throw err;
+      return data;
+    } catch (err) {
+      lastErr = err;
+      const cause = err?.cause?.code || err?.cause?.message || err?.cause || '';
+      const retryable = RETRYABLE_CAUSES.has(err?.cause?.code) && attempt < MAX_ATTEMPTS;
+      if (retryable) {
+        console.error(`API Retry ${attempt}/${MAX_ATTEMPTS - 1} after ${cause}`);
+        await sleep(1000 * attempt);
+        continue;
+      }
+      console.error(`API Error: ${err.message}${cause ? ` (cause: ${cause})` : ''}`);
+      throw err;
+    }
   }
+  throw lastErr;
 };
 
 export { fetchApi };

package/src/utils/loginFlow.js

@@ -0,0 +1,75 @@
+import { randomUUID } from 'crypto';
+import { getConfigValue, setConfigValue } from './config.js';
+import { getBaseUrl, getDashboardUrl } from './baseUrl.js';
+
+const DEFAULT_POLL_INTERVAL = 10_000;
+const DEFAULT_TIMEOUT = 10 * 60 * 1000;
+
+export function isAlreadyLoggedIn() {
+  return !!getConfigValue('apiKeyV2');
+}
+
+export async function startLoginFlow() {
+  const token = randomUUID();
+  const baseUrl = getBaseUrl();
+  const dashboardUrl = await getDashboardUrl();
+  const loginUrl = `${dashboardUrl}?ideLoginToken=${token}`;
+  const pollUrl = `${baseUrl}/extension/login/status?apiKey=${token}`;
+
+  let browserOpened = false;
+  try {
+    const { default: open } = await import('open');
+    await open(loginUrl);
+    browserOpened = true;
+  } catch {
+    // Caller can fall back to printing loginUrl.
+  }
+
+  return { token, loginUrl, pollUrl, browserOpened };
+}
+
+export async function awaitLoginCompletion({
+  token,
+  pollUrl,
+  pollIntervalMs = DEFAULT_POLL_INTERVAL,
+  timeoutMs = DEFAULT_TIMEOUT,
+  signal,
+} = {}) {
+  if (!token || !pollUrl) {
+    throw new Error('awaitLoginCompletion requires token and pollUrl');
+  }
+
+  const deadline = Date.now() + timeoutMs;
+
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error('Login aborted');
+
+    try {
+      const response = await fetch(pollUrl);
+      const data = await response.json();
+      if (data.status === 'yes') {
+        setConfigValue('apiKeyV2', token);
+        process.env.CODEANT_API_TOKEN = token;
+        return { ok: true, token };
+      }
+    } catch {
+      // Network blip — keep polling.
+    }
+
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    await new Promise((resolve) => setTimeout(resolve, Math.min(pollIntervalMs, remaining)));
+  }
+
+  throw new Error('Login timed out. Please try again.');
+}
+
+export async function runLoginFlow({
+  pollIntervalMs = DEFAULT_POLL_INTERVAL,
+  timeoutMs = DEFAULT_TIMEOUT,
+  signal,
+} = {}) {
+  const { token, loginUrl, pollUrl, browserOpened } = await startLoginFlow();
+  const result = await awaitLoginCompletion({ token, pollUrl, pollIntervalMs, timeoutMs, signal });
+  return { ...result, loginUrl, browserOpened };
+}

package/src/utils/reviewApiHelper.js

@@ -265,33 +265,39 @@ class ReviewApiHelper extends CommonApiHelper {
   }
 
   /**
-   * Split a combined review request into per-file payloads.
-   * Each payload has a single file's diff and content.
+   * Split a combined review request into batched payloads.
+   * Files are grouped in chunks of up to FILES_PER_BATCH so each backend
+   * session reviews multiple files at once (matches pragent's batching).
    */
-  static splitIntoPerFileRequests(requestBody) {
+  static splitIntoPerFileRequests(requestBody, batchSize = 5) {
     if (!requestBody?.diff_content?.length) return [];
 
     const fileSections = requestBody.diff_content.split(/(?=^diff --git )/m).filter(Boolean);
-    const perFileRequests = [];
+    const perFile = [];
 
     for (const section of fileSections) {
       const nameMatch = section.match(/^diff --git a\/.+ b\/(.+)$/m);
       if (!nameMatch) continue;
-      const filename = nameMatch[1];
+      perFile.push({ section, filename: nameMatch[1] });
+    }
 
+    const batches = [];
+    for (let i = 0; i < perFile.length; i += batchSize) {
+      const slice = perFile.slice(i, i + batchSize);
       const fileContents = {};
-      if (requestBody.file_contents?.[filename]) {
-        fileContents[filename] = requestBody.file_contents[filename];
+      for (const { filename } of slice) {
+        if (requestBody.file_contents?.[filename]) {
+          fileContents[filename] = requestBody.file_contents[filename];
+        }
       }
-
-      perFileRequests.push({
-        diff_content: section,
+      batches.push({
+        diff_content: slice.map((f) => f.section).join(''),
         file_contents: fileContents,
-        _filename: filename,
+        _filenames: slice.map((f) => f.filename),
       });
     }
 
-    return perFileRequests;
+    return batches;
   }
 }