codeant-cli 0.4.9 → 0.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "description": "Code review CLI tool",
   "type": "module",
   "bin": {

package/src/commands/scans/index.js

@@ -71,7 +71,8 @@ export default function registerScansCommands(program, { runCmd }) {
     .option('--severity <list>', 'Filter by severity (e.g. critical,high)')
     .option('--path <glob>', 'Filter by file path glob')
     .option('--check <regex>', 'Filter by check ID or name (regex)')
-    .option('--include-dismissed', 'Include dismissed findings (excluded by default)')
+    .option('--filter-dismissed', 'Exclude dismissed findings (default: false)')
+    .option('--no-false-positives', 'Exclude false positives (default: included)')
     .option('--format <fmt>', 'Output format: json|sarif|csv|md|table (default: json)', 'json')
     .option('--output <path>', 'Write output to file instead of stdout')
     .option('--fields <list>', 'Project findings to subset of fields (comma-separated)')
@@ -96,7 +97,8 @@ export default function registerScansCommands(program, { runCmd }) {
           severity: opts.severity,
           path: opts.path,
           check: opts.check,
-          includeDismissed: opts.includeDismissed || false,
+          filterDismissed: opts.filterDismissed || false,
+          includeFalsePositives: opts.falsePositives ?? true,
           format: opts.format,
           output: opts.output,
           fields: opts.fields,

package/src/commands/scans/lib/filters.js

@@ -1,29 +1,22 @@
 import { minimatch } from 'minimatch';
-import { isDismissed, findDismissMatch } from './dismissMatch.js';
 import { normalizeSeverity } from './normalize.js';
 
-const SEV_RANK = { critical: 5, high: 4, medium: 3, low: 2, info: 1, unknown: 0 };
-
 /**
- * Apply all filters to findings in-place (returns new array).
+ * Apply client-side filters to findings (returns new array).
+ * Dismissed / false-positive filtering is handled exclusively by the backend.
  *
  * @param {Array} findings - NormalizedFinding[]
  * @param {object} opts
- * @param {string[]|null} opts.severity  - allowed severity levels (e.g. ['critical','high'])
- * @param {string|null}   opts.pathGlob  - minimatch glob for file_path
+ * @param {string[]|null} opts.severity   - allowed severity levels (e.g. ['critical','high'])
+ * @param {string|null}   opts.pathGlob   - minimatch glob for file_path
  * @param {string|null}   opts.checkRegex - regex applied to check_id + check_name
- * @param {Array}         opts.dismissedAlerts - from fetchDismissedAlerts()
- * @param {boolean}       opts.includeDismissed
- * @returns {Array} filtered NormalizedFinding[] (dismissed field annotated)
+ * @returns {Array} filtered NormalizedFinding[]
  */
 export function applyFilters(findings, {
   severity = null,
   pathGlob = null,
   checkRegex = null,
-  dismissedAlerts = [],
-  includeDismissed = false,
 } = {}) {
-  // Pre-compile regex — strip Python/PCRE inline flag (?i) and fold into JS flag
   let checkRe = null;
   if (checkRegex) {
     try {
@@ -37,35 +30,15 @@ export function applyFilters(findings, {
     }
   }
 
-  // Severity set
   const sevSet = severity && severity.length > 0
     ? new Set(severity.map((s) => normalizeSeverity(s)))
     : null;
 
   const result = [];
   for (const f of findings) {
-    // Annotate dismiss status
-    const match = findDismissMatch(f, dismissedAlerts);
-    f.dismissed = match !== null;
-    if (match) {
-      f.dismiss_info = {
-        reason: match.reason_for_dismiss || null,
-        comment: match.comment_for_dismiss || null,
-      };
-    }
-
-    // Filter dismissed
-    if (f.dismissed && !includeDismissed) continue;
-
-    // Filter by severity
     if (sevSet && !sevSet.has(f.severity)) continue;
-
-    // Filter by path glob
     if (pathGlob && !minimatch(f.file_path, pathGlob, { matchBase: true })) continue;
-
-    // Filter by check regex
     if (checkRe && !checkRe.test(f.check_id) && !checkRe.test(f.check_name)) continue;
-
     result.push(f);
   }
   return result;

package/src/commands/scans/lib/normalize.js

@@ -106,8 +106,6 @@ export function normalizeIssue(issue, category) {
     cve: cve ? String(cve) : null,
     package: packageInfo,
     metadata,
-    dismissed: false,
-    dismiss_info: null,
   };
 }
 

package/src/commands/scans/results.js

@@ -7,7 +7,6 @@ import { paginate } from './lib/paginate.js';
 import { emit } from './lib/emit.js';
 import { progress, logError } from './lib/log.js';
 import { FORMATTERS } from './formatters/index.js';
-import { fetchDismissedAlerts } from '../../scans/fetchDismissedAlerts.js';
 
 /**
  * codeant scans results — full orchestration.
@@ -23,7 +22,8 @@ export async function runResults(opts = {}) {
     severity,
     path: pathGlob,
     check: checkRegex,
-    includeDismissed = false,
+    filterDismissed = false,
+    includeFalsePositives = true,
     format = 'json',
     output: outputPath = null,
     fields = null,
@@ -53,16 +53,12 @@ export async function runResults(opts = {}) {
   // 2. Parse types
   const categories = parseTypes(types);
 
-  // 3. Fetch in parallel + dismissed alerts
+  // 3. Fetch in parallel
   progress(`fetching ${categories.map((c) => c.key).join(', ')}…`);
-  const [settled, dismissedResult] = await Promise.all([
-    Promise.allSettled(categories.map((c) => c.fetcher(repo, scanMeta.commit_id))),
-    includeDismissed
-      ? Promise.resolve({ success: true, dismissedAlerts: [] })
-      : fetchDismissedAlerts(repo, 'security'),
-  ]);
-
-  const dismissedAlerts = dismissedResult.success ? (dismissedResult.dismissedAlerts ?? []) : [];
+  const fetchOpts = { filterDismissed, includeFalsePositives };
+  const settled = await Promise.allSettled(
+    categories.map((c) => c.fetcher(repo, scanMeta.commit_id, fetchOpts))
+  );
 
   // 4. Collect findings + errors
   const allFindings = [];
@@ -100,8 +96,6 @@ export async function runResults(opts = {}) {
     severity: severityList,
     pathGlob: pathGlob || null,
     checkRegex: checkRegex || null,
-    dismissedAlerts,
-    includeDismissed,
   });
 
   // 6. Sort
@@ -115,7 +109,8 @@ export async function runResults(opts = {}) {
     severity: severityList,
     path: pathGlob || null,
     check: checkRegex || null,
-    include_dismissed: includeDismissed,
+    filter_dismissed: filterDismissed,
+    include_false_positives: includeFalsePositives,
   };
 
   // Rebuild summary from all filtered (pre-page) findings

package/src/components/ScanCenter.js

@@ -153,7 +153,7 @@ function ErrorView({ message, onBack, canGoBack }) {
 
 // ─── Main ScanCenter ─────────────────────────────────────────────────────────
 
-export default function ScanCenter() {
+export default function ScanCenter({ filterDismissed = false, includeFalsePositives = true }) {
   const { exit } = useApp();
 
   const [step, setStep] = useState(STEPS.LOADING);
@@ -198,7 +198,7 @@ export default function ScanCenter() {
 
   // ── Step 5: result type selected → fetch exactly one endpoint ──
   const handleSelectResultType = (item) =>
-    _handleSelectResultType({ STEPS, item, selectedRepo, selectedScan, setSelectedResultType, setStep, setLoadingMsg, setError, setResults });
+    _handleSelectResultType({ STEPS, item, selectedRepo, selectedScan, setSelectedResultType, setStep, setLoadingMsg, setError, setResults, filterDismissed, includeFalsePositives });
 
   // ── Back navigation ──
   const goBack = {

package/src/index.js

@@ -211,8 +211,13 @@ program
   program
     .command('scan-center')
     .description('Browse scan results interactively')
-    .action(() => {
-      render(React.createElement(ScanCenter));
+    .option('--filter-dismissed', 'Exclude dismissed alerts from results (default: false)')
+    .option('--no-false-positives', 'Exclude false positives from results (default: included)')
+    .action((options) => {
+      render(React.createElement(ScanCenter, {
+        filterDismissed: options.filterDismissed ?? false,
+        includeFalsePositives: options.falsePositives ?? true,
+      }));
     });
 
   program

package/src/scanCenter/handleSelectResultType.js

@@ -2,7 +2,7 @@ import { fetchScanResults } from '../scans/fetchScanResults.js';
 import { fetchAdvancedScanResults } from '../scans/fetchAdvancedScanResults.js';
 import { fetchDismissedAlerts } from '../scans/fetchDismissedAlerts.js';
 
-export async function handleSelectResultType({ STEPS, item, selectedRepo, selectedScan, setSelectedResultType, setStep, setLoadingMsg, setError, setResults }) {
+export async function handleSelectResultType({ STEPS, item, selectedRepo, selectedScan, setSelectedResultType, setStep, setLoadingMsg, setError, setResults, filterDismissed = false, includeFalsePositives = true }) {
   const rt = item.value;
   setSelectedResultType(rt);
   setStep(STEPS.LOADING);
@@ -10,12 +10,13 @@ export async function handleSelectResultType({ STEPS, item, selectedRepo, select
 
   const repo = selectedRepo.full_name;
   const commitId = selectedScan.commitId;
+  const fetchOpts = { filterDismissed, includeFalsePositives };
   let res;
 
   if (rt.kind === 'basic') {
-    res = await fetchScanResults(repo, commitId, rt.value);
+    res = await fetchScanResults(repo, commitId, rt.value, fetchOpts);
   } else if (rt.kind === 'advanced') {
-    res = await fetchAdvancedScanResults(repo, commitId, rt.value);
+    res = await fetchAdvancedScanResults(repo, commitId, rt.value, fetchOpts);
   } else if (rt.value === 'dismissed_alerts') {
     const r = await fetchDismissedAlerts(repo, 'security');
     res = r.success ? { success: true, issues: r.dismissedAlerts } : r;

package/src/scans/fetchAdvancedScanResults.js

@@ -200,9 +200,12 @@ function normalizeAdvancedIssue(item, resultType) {
  * @param {string} repo       - "org/repo-name"
  * @param {string} commitId   - 40-char commit SHA
  * @param {string} resultType - one of ADVANCED_RESULT_TYPES values
+ * @param {{ filterDismissed?: boolean, includeFalsePositives?: boolean }} [opts]
  * @returns {Promise<{ success: boolean, issues?: Array, healthyPackages?: Array, status?: string, error?: string }>}
  */
-export async function fetchAdvancedScanResults(repo, commitId, resultType) {
+export async function fetchAdvancedScanResults(repo, commitId, resultType, opts = {}) {
+  const { filterDismissed = false, includeFalsePositives = true } = opts;
+
   if (!Object.values(ADVANCED_RESULT_TYPES).includes(resultType)) {
     return {
       success: false,
@@ -215,6 +218,8 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType) {
       repo,
       commit_id: commitId,
       result_type: resultType,
+      filter_dismissed: filterDismissed,
+      include_false_positives: includeFalsePositives,
     });
 
     if (!response) {
@@ -294,8 +299,8 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType) {
       }
     }
 
-    // Filter secrets false positives
-    if (resultType === ADVANCED_RESULT_TYPES.SECRETS) {
+    // Filter secrets false positives only when caller explicitly excludes them
+    if (resultType === ADVANCED_RESULT_TYPES.SECRETS && !includeFalsePositives) {
       issues = issues.filter((issue) => String(issue.confidence_score || '').toLowerCase() !== 'false_positive');
     }
 
@@ -309,17 +314,17 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType) {
   }
 }
 
-export const fetchScaResults = (repo, commitId) =>
-  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SCA);
+export const fetchScaResults = (repo, commitId, opts) =>
+  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SCA, opts);
 
-export const fetchSbomResults = (repo, commitId) =>
-  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SBOM);
+export const fetchSbomResults = (repo, commitId, opts) =>
+  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SBOM, opts);
 
-export const fetchSecretsResults = (repo, commitId) =>
-  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SECRETS);
+export const fetchSecretsResults = (repo, commitId, opts) =>
+  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.SECRETS, opts);
 
-export const fetchIacResults = (repo, commitId) =>
-  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.IAC);
+export const fetchIacResults = (repo, commitId, opts) =>
+  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.IAC, opts);
 
-export const fetchDeadCodeResults = (repo, commitId) =>
-  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DEAD_CODE);
+export const fetchDeadCodeResults = (repo, commitId, opts) =>
+  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DEAD_CODE, opts);

package/src/scans/fetchScanResults.js

@@ -49,9 +49,12 @@ function extractCleanPath(fullPath, commitId, suffix = null) {
  * @param {string} repo      - "org/repo-name"
  * @param {string} commitId  - 40-char commit SHA
  * @param {string} resultType - one of VALID_RESULT_TYPES values
+ * @param {{ filterDismissed?: boolean, includeFalsePositives?: boolean }} [opts]
  * @returns {Promise<{ success: boolean, issues?: Array, status?: string, error?: string }>}
  */
-export async function fetchScanResults(repo, commitId, resultType) {
+export async function fetchScanResults(repo, commitId, resultType, opts = {}) {
+  const { filterDismissed = false, includeFalsePositives = true } = opts;
+
   if (!Object.values(VALID_RESULT_TYPES).includes(resultType)) {
     return {
       success: false,
@@ -64,6 +67,8 @@ export async function fetchScanResults(repo, commitId, resultType) {
       repo,
       commit_id: commitId,
       result_type: resultType,
+      filter_dismissed: filterDismissed,
+      include_false_positives: includeFalsePositives,
     });
 
     if (!response) {
@@ -102,14 +107,14 @@ export async function fetchScanResults(repo, commitId, resultType) {
   }
 }
 
-export const fetchSastResults = (repo, commitId) =>
-  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.SECURITY_ISSUES);
+export const fetchSastResults = (repo, commitId, opts) =>
+  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.SECURITY_ISSUES, opts);
 
-export const fetchAntiPatternsResults = (repo, commitId) =>
-  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.ANTI_PATTERNS);
+export const fetchAntiPatternsResults = (repo, commitId, opts) =>
+  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.ANTI_PATTERNS, opts);
 
-export const fetchDocstringResults = (repo, commitId) =>
-  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.DOCSTRING);
+export const fetchDocstringResults = (repo, commitId, opts) =>
+  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.DOCSTRING, opts);
 
-export const fetchComplexFunctionsResults = (repo, commitId) =>
-  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.COMPLEX_FUNCTIONS);
+export const fetchComplexFunctionsResults = (repo, commitId, opts) =>
+  fetchScanResults(repo, commitId, VALID_RESULT_TYPES.COMPLEX_FUNCTIONS, opts);

package/src/utils/reviewApiHelper.js

@@ -3,7 +3,7 @@ import path from 'path';
 import fs from 'fs';
 import { minimatch } from 'minimatch';
 
-const MAX_REVIEW_FILES = 10;
+const MAX_REVIEW_FILES = 15;
 const MAX_FILE_LINES = 5000;
 const MAX_FILE_SIZE_BYTES = 200 * 1024; // 200 KB
 
@@ -184,41 +184,20 @@ class ReviewApiHelper extends CommonApiHelper {
       return true;
     });
 
-    // Dedupe by filename, keeping all hunks, but limit unique files to MAX_REVIEW_FILES
+    // Dedupe by filename, keeping all hunks (no cap yet — applied after size filtering)
     const fileOrder = [];
     const fileHunks = new Map();
-    let capped = false;
     for (const d of reviewable) {
       const f = d.filename_str;
       if (!fileHunks.has(f)) {
-        if (fileOrder.length >= MAX_REVIEW_FILES) {
-          capped = true;
-          if (!seenSkipped.has(f)) {
-            dedupedSkipped.push({ file: f, reason: `exceeded ${MAX_REVIEW_FILES}-file limit` });
-            seenSkipped.add(f);
-          }
-          continue;
-        }
         fileOrder.push(f);
         fileHunks.set(f, []);
       }
       fileHunks.get(f).push(d);
     }
 
-    // Reconstruct a combined diff string from the filtered hunks
-    const parts = [];
-    for (const f of fileOrder) {
-      const hunks = fileHunks.get(f);
-      // Build a file-level diff header + all hunk patches
-      const header = `diff --git a/${f} b/${f}\n--- a/${f}\n+++ b/${f}`;
-      const hunkPatches = hunks.map(h => h.patch_str).filter(Boolean);
-      if (hunkPatches.length > 0) {
-        parts.push(header + '\n' + hunkPatches.join('\n'));
-      }
-    }
-
     // Use head_file_str from diffs so file content matches the diff version (avoids working tree mismatch for --last-commit etc.)
-    const fileContents = {};
+    // Filter out files that exceed size or line limits before applying the cap
     const skippedLargeFiles = new Set();
     for (const f of fileOrder) {
       const hunks = fileHunks.get(f);
@@ -234,21 +213,49 @@ class ReviewApiHelper extends CommonApiHelper {
         if (lineCount > MAX_FILE_LINES) {
           skippedLargeFiles.add(f);
           dedupedSkipped.push({ file: f, reason: `too large (${lineCount} lines, max ${MAX_FILE_LINES})` });
-          continue;
         }
-        fileContents[f] = content;
       }
     }
 
-    // Remove diff sections for skipped files
-    const filteredParts = parts.filter((_, i) => !skippedLargeFiles.has(fileOrder[i]));
+    // Apply MAX_REVIEW_FILES cap after all filtering (binary, deleted, pattern, size)
+    let capped = false;
+    const cappedFileOrder = [];
+    for (const f of fileOrder) {
+      if (skippedLargeFiles.has(f)) continue;
+      if (cappedFileOrder.length >= MAX_REVIEW_FILES) {
+        capped = true;
+        if (!seenSkipped.has(f)) {
+          dedupedSkipped.push({ file: f, reason: `exceeded ${MAX_REVIEW_FILES}-file limit` });
+          seenSkipped.add(f);
+        }
+        continue;
+      }
+      cappedFileOrder.push(f);
+    }
+
+    // Build file contents for the capped set
+    const fileContents = {};
+    for (const f of cappedFileOrder) {
+      const content = fileHunks.get(f)[0]?.head_file_str || '';
+      if (content) fileContents[f] = content;
+    }
+
+    // Reconstruct a combined diff string from the capped set
+    const parts = [];
+    for (const f of cappedFileOrder) {
+      const hunks = fileHunks.get(f);
+      const header = `diff --git a/${f} b/${f}\n--- a/${f}\n+++ b/${f}`;
+      const hunkPatches = hunks.map(h => h.patch_str).filter(Boolean);
+      if (hunkPatches.length > 0) {
+        parts.push(header + '\n' + hunkPatches.join('\n'));
+      }
+    }
 
-    const reviewedFiles = fileOrder.filter(f => !skippedLargeFiles.has(f));
     return {
-      diff_content: filteredParts.join('\n'),
+      diff_content: parts.join('\n'),
       file_contents: fileContents,
       _meta: {
-        reviewed_files: reviewedFiles,
+        reviewed_files: cappedFileOrder,
         total_changed: allUniqueFiles.size,
         skipped: dedupedSkipped,
         capped,