codeant-cli 0.5.8 → 0.5.10

package/src/mcp/shape.js

@@ -0,0 +1,83 @@
+// Result shaping for MCP clients, which cap how much tool output they accept.
+// CLI commands keep returning the full payloads; only MCP responses are trimmed.
+
+const DEFAULT_MAX_RESULT_CHARS = 80_000;
+
+const REPO_FIELDS = ['full_name', 'name', 'private', 'visibility', 'default_branch', 'language', 'description', 'archived', 'pushed_at'];
+const CLOUD_SCAN_DETAIL = ['per_service', 'service_rollup', 'compliance_rollup', 'regions'];
+
+export function maxResultChars() {
+  const configured = Number(process.env.CODEANT_MCP_MAX_RESULT_CHARS);
+  return Number.isInteger(configured) && configured > 0 ? configured : DEFAULT_MAX_RESULT_CHARS;
+}
+
+function page(items, { limit, offset = 0 }) {
+  const slice = items.slice(offset, offset + limit);
+  const end = offset + slice.length;
+  return { items: slice, total: items.length, offset, limit, next_offset: end < items.length ? end : null };
+}
+
+function pick(record, fields) {
+  const picked = {};
+  for (const field of fields) if (field in record) picked[field] = record[field];
+  return Object.keys(picked).length ? picked : record;
+}
+
+function omit(record, fields) {
+  const kept = { ...record };
+  for (const field of fields) delete kept[field];
+  return kept;
+}
+
+export function shapeRepos(result, { search, limit = 100, offset = 0, full = false } = {}) {
+  let repos = result.repos || [];
+  if (search) {
+    const query = search.toLowerCase();
+    repos = repos.filter((repo) => String(repo.full_name || repo.name || '').toLowerCase().includes(query));
+  }
+  const { items, ...pagination } = page(repos, { limit, offset });
+  return { org: result.org, ...pagination, repos: full ? items : items.map((repo) => pick(repo, REPO_FIELDS)) };
+}
+
+export function shapePentestHistory(result, { limit = 25, offset = 0, full = false } = {}) {
+  const { history = [], ...rest } = result;
+  const { items, ...pagination } = page(history, { limit, offset });
+  return { ...rest, ...pagination, history: full ? items : items.map((entry) => omit(entry, ['credit_unlock'])) };
+}
+
+function shapeCloudScans(result, { limit, offset, full }) {
+  if (!Array.isArray(result?.scans)) return result;
+  const { items, ...pagination } = page(result.scans, { limit, offset });
+  return {
+    ...result,
+    ...pagination,
+    total: result.total ?? pagination.total,
+    scans: full ? items : items.map((scan) => omit(scan, CLOUD_SCAN_DETAIL)),
+  };
+}
+
+export function shapeCloudHistory(result, { limit = 10, offset = 0, full = false } = {}) {
+  if (!result.providers) return shapeCloudScans(result, { limit, offset, full });
+  const providers = Object.fromEntries(
+    Object.entries(result.providers).map(([provider, value]) => [provider, shapeCloudScans(value, { limit, offset, full })]),
+  );
+  return { ...result, providers };
+}
+
+// CSPM findings come back unpaged (thousands per scan); VM/container results are
+// already paged by the API, so only the per-finding detail is trimmed for them.
+export function shapeCloudFindings(result, { kind = 'cspm', limit = 25, offset = 0, all = false, full = false } = {}) {
+  const { findings = [], ...rest } = result;
+  const trim = (items) => (full ? items : items.map((finding) => omit(finding, ['compliance'])));
+  if (kind !== 'cspm') return { ...rest, findings: trim(findings) };
+  const { items, ...pagination } = page(findings, { limit: all ? findings.length : limit, offset });
+  return { ...rest, ...pagination, total: rest.total ?? pagination.total, findings: trim(items) };
+}
+
+export function tooLarge(length, hint) {
+  const max = maxResultChars();
+  return {
+    error: `Result too large: ${length} characters (about ${Math.round(length / 4)} tokens), over the ${max}-character limit for one tool result.`,
+    hint: `${hint || 'Narrow the request with limit/offset, filters, or fields where the tool supports them.'} Set CODEANT_MCP_MAX_RESULT_CHARS to raise the limit.`,
+  };
+}

package/src/scans/fetchAdvancedScanResults.js

@@ -6,8 +6,23 @@ export const ADVANCED_RESULT_TYPES = {
   SECRETS: 'secrets',
   IAC: 'iac',
   DEAD_CODE: 'dead_code',
+  DUPLICATE_CODE: 'duplicate_code',
 };
 
+const BACKEND_MARKERS = ['is_dismissed', 'reason_for_dismiss', 'comment_for_dismiss', 'is_false_positive'];
+
+/**
+ * Dismissed / false-positive markers the backend stamps on each finding. Kept
+ * when a finding is rebuilt so callers can hide or show those findings.
+ */
+function backendMarkers(item) {
+  const markers = {};
+  for (const key of BACKEND_MARKERS) {
+    if (item?.[key] !== undefined) markers[key] = item[key];
+  }
+  return markers;
+}
+
 const EXTRA_DEAD_CODE_MESSAGES = {
   S1481: 'Unused local variable',
   S1854: 'Unused assignment',
@@ -74,12 +89,16 @@ function flattenDeadCode(deadCodeData) {
         name,
         confidence: confMatch ? confMatch[1] : '90',
         check_name: `Unused ${issueType}: ${name}`,
+        ...backendMarkers(issue),
       });
     });
   });
 
-  // JS dead code — unused files
+  // JS dead code — unused files (plain path strings; the backend lists dismissed ones separately)
   const jsDeadCode = deadCodeData.js_dead_code || {};
+  const dismissedFiles = Array.isArray(jsDeadCode.dismissed_unused_files)
+    ? new Set(jsDeadCode.dismissed_unused_files)
+    : null;
   (jsDeadCode.unused_files || []).forEach((filePath) => {
     if (!filePath) return;
     flat.push({
@@ -90,6 +109,7 @@ function flattenDeadCode(deadCodeData) {
       severity: 'warning',
       type: 'unused_file',
       check_name: 'Unused file',
+      ...(dismissedFiles ? { is_dismissed: dismissedFiles.has(filePath) } : {}),
     });
   });
 
@@ -110,6 +130,7 @@ function flattenDeadCode(deadCodeData) {
         type: 'unused_export',
         name: exp.name,
         check_name: `Unused export: ${exp.name || 'unknown'}`,
+        ...backendMarkers(exp),
       });
     });
   });
@@ -124,7 +145,8 @@ function flattenDeadCode(deadCodeData) {
         const messageId = issue['message-id'] || '';
         const msgKey = messageId.includes(':') ? messageId.split(':')[1] : messageId;
         flat.push({
-          file_path: extractRelativeFilePath(filePath),
+          // Keys end with the per-file result name (".../app.py/dead_code.json").
+          file_path: extractRelativeFilePath(filePath).replace(/\/[^/]+\.json$/, ''),
           line_number: issue.line_number || 0,
           issue_text: issue.issue_text || EXTRA_DEAD_CODE_MESSAGES[msgKey] || 'Dead code detected',
           message: issue.issue_text || EXTRA_DEAD_CODE_MESSAGES[msgKey] || 'Dead code detected',
@@ -133,6 +155,7 @@ function flattenDeadCode(deadCodeData) {
           rule_id: msgKey,
           confidence: issue.confidence || '90',
           check_name: EXTRA_DEAD_CODE_MESSAGES[msgKey] || 'Dead code detected',
+          ...backendMarkers(issue),
         });
       });
     });
@@ -141,6 +164,49 @@ function flattenDeadCode(deadCodeData) {
   return flat;
 }
 
+/** "[12-40]" → [12, 40]; anything unparsable → []. */
+function parseWindow(window) {
+  const numbers = String(window ?? '').match(/\d+/g) || [];
+  return numbers.slice(0, 2).map(Number);
+}
+
+/**
+ * Flatten duplicate-code clone groups (each a list of { fileName, window }
+ * members) into one finding per member, linked by their group index.
+ */
+function flattenDuplicateCode(groups) {
+  if (!Array.isArray(groups)) return [];
+  const flat = [];
+  groups.forEach((group, groupIndex) => {
+    const members = Array.isArray(group) ? group.filter((m) => m && typeof m === 'object') : [];
+    const locations = members.map((m) => {
+      const [start, end] = parseWindow(m.window);
+      return { file_path: extractRelativeFilePath(cleanLeadingSlash(m.fileName)), start, end };
+    });
+    members.forEach((member, i) => {
+      const { file_path, start, end } = locations[i];
+      const others = locations
+        .filter((_, j) => j !== i)
+        .map((o) => (o.start ? `${o.file_path}:${o.start}${o.end ? `-${o.end}` : ''}` : o.file_path));
+      const message = `Duplicated block (${members.length} locations)`;
+      flat.push({
+        file_path,
+        line_number: start || 1,
+        file_line_range: end ? [start, end] : [start || 1],
+        check_id: 'duplicate-code',
+        check_name: message,
+        issue_text: message,
+        message,
+        severity: 'low',
+        duplicate_group: member.originalIndex ?? groupIndex,
+        duplicate_locations: others,
+        ...backendMarkers(member),
+      });
+    });
+  });
+  return flat;
+}
+
 /**
  * Normalize a single advanced issue to a consistent shape.
  */
@@ -163,7 +229,8 @@ function normalizeAdvancedIssue(item, resultType) {
         item.vulnerability_id || item.cve_id || item.advisory_id ||
         (item.package_name ? `Vulnerability in ${item.package_name}` : null) ||
         item.title || item.description || 'Package vulnerability detected';
-      normalized.severity = item.severity || 'medium';
+      // SCA findings carry severity in ratings (where Change Severity overrides land).
+      normalized.severity = item.severity || item.ratings?.[0]?.severity || 'medium';
       break;
     case ADVANCED_RESULT_TYPES.SBOM:
       normalized.check_name = item.package_name
@@ -187,6 +254,10 @@ function normalizeAdvancedIssue(item, resultType) {
         item.check_name || item.name || item.function_name || item.symbol_name || item.description || 'Unused code detected';
       normalized.severity = item.severity || 'low';
       break;
+    case ADVANCED_RESULT_TYPES.DUPLICATE_CODE:
+      normalized.check_name = item.check_name || 'Duplicated block';
+      normalized.severity = item.severity || 'low';
+      break;
     default:
       normalized.check_name = item.description || item.message || item.name || 'Issue detected';
   }
@@ -195,7 +266,7 @@ function normalizeAdvancedIssue(item, resultType) {
 }
 
 /**
- * Fetch advanced scan results (SCA, SBOM, secrets, IaC, dead code).
+ * Fetch advanced scan results (SCA, SBOM, secrets, IaC, dead code, duplicate code).
  *
  * @param {string} repo       - "org/repo-name"
  * @param {string} commitId   - 40-char commit SHA
@@ -237,6 +308,8 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType, opts
       resultsData = response.secrets;
     } else if (resultType === ADVANCED_RESULT_TYPES.DEAD_CODE) {
       resultsData = flattenDeadCode(response.dead_code);
+    } else if (resultType === ADVANCED_RESULT_TYPES.DUPLICATE_CODE) {
+      resultsData = flattenDuplicateCode(response.results);
     } else if (resultType === ADVANCED_RESULT_TYPES.SCA) {
       const scaResults = response.results;
       if (scaResults && typeof scaResults === 'object' && !Array.isArray(scaResults) && scaResults.all_vulnerabilities !== undefined) {
@@ -268,6 +341,7 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType, opts
                 guideline: check.guideline || '',
                 code_block: check.code_block || [],
                 resource: check.resource || '',
+                ...backendMarkers(check),
               });
             });
           });
@@ -328,3 +402,6 @@ export const fetchIacResults = (repo, commitId, opts) =>
 
 export const fetchDeadCodeResults = (repo, commitId, opts) =>
   fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DEAD_CODE, opts);
+
+export const fetchDuplicateCodeResults = (repo, commitId, opts) =>
+  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DUPLICATE_CODE, opts);

package/src/scans/fetchDismissedAlerts.js

@@ -29,7 +29,21 @@ export async function fetchDismissedAlerts(repo, analysisType = 'security') {
     const dismissedAlerts = [];
 
     for (const [issueKey, dismissInfo] of Object.entries(dismissData)) {
-      if (!issueKey.includes('||::||')) continue;
+      if (!issueKey.includes('||::||')) {
+        // SCA ("pkg@version[::manifest::cve]") and duplicate-code (group index)
+        // keys have no file/line parts; keep them so the count is complete.
+        dismissedAlerts.push({
+          file_path: '',
+          context_code_block: '',
+          test_id: '',
+          line_number: 0,
+          type: '',
+          issue_key: issueKey,
+          reason_for_dismiss: dismissInfo?.reason_for_dismiss || '',
+          comment_for_dismiss: dismissInfo?.comment_for_dismiss || '',
+        });
+        continue;
+      }
 
       const parts = issueKey.split('||::||');
       let file_path = parts[0] || '';

package/src/scans/fetchIssueOverrides.js

@@ -0,0 +1,36 @@
+import { fetchApi } from '../utils/fetchApi.js';
+
+/**
+ * Fetch the per-finding user overrides the web app saves for a repository
+ * (Mark/Unmark false positive, secrets confidence, Change Severity).
+ *
+ * Override keys and patches by analysis type:
+ *   security — "id::<tracking id>|rule::<test_id>||::||<result key>||::||<line>" → { false_positive, severity }
+ *   secrets  — "<path>||::||<hashed_secret or line>||::||<type>"               → { confidence_score }
+ *   iac      — "<file_path>||::||<check_id>||::||<start>-<end>"                → { false_positive }
+ *   sca      — "<package>@<version>"                                           → { severity }
+ *
+ * @param {string} repo         - "org/repo-name"
+ * @param {string} analysisType - security | secrets | iac | sca
+ * @returns {Promise<{ success: boolean, overrides?: Object, error?: string }>}
+ */
+export async function fetchIssueOverrides(repo, analysisType) {
+  try {
+    const response = await fetchApi('/extension/scans2/change-issue-details/get', 'POST', {
+      repo,
+      analysis_type: analysisType,
+    });
+
+    if (!response) {
+      return { success: false, error: 'Failed to connect to CodeAnt server' };
+    }
+
+    if (response.status === 'error') {
+      return { success: false, error: response.message || 'Failed to fetch issue overrides' };
+    }
+
+    return { success: true, overrides: response.data || {} };
+  } catch (error) {
+    return { success: false, error: error.message || 'Failed to fetch issue overrides' };
+  }
+}

package/src/scans/fetchScanResults.js

@@ -70,7 +70,6 @@ export async function fetchScanResults(repo, commitId, resultType, opts = {}) {
       filter_dismissed: filterDismissed,
       include_false_positives: includeFalsePositives,
     });
-    console.error("dropship: ", JSON.stringify(response, null, 2));
 
     if (!response) {
       return { success: false, error: 'Failed to connect to CodeAnt server' };

package/src/scm/azure/client.js

@@ -7,7 +7,7 @@ export function getConnection() {
   if (!token) throw new Error('Azure DevOps token not found. Set AZURE_DEVOPS_TOKEN env var or run `codeant set-token azure <token>`.');
 
   const orgUrl = process.env.AZURE_DEVOPS_ORG_URL || getConfigValue('azureDevOpsOrgUrl');
-  if (!orgUrl) throw new Error('Azure DevOps org URL not found. Set AZURE_DEVOPS_ORG_URL env var or run `codeant set-azure-org <url>`.');
+  if (!orgUrl) throw new Error('Azure DevOps org URL not found. Set the AZURE_DEVOPS_ORG_URL env var (for example https://dev.azure.com/<org>) or add azureDevOpsOrgUrl to ~/.codeant/config.json.');
 
   const authHandler = azdev.getPersonalAccessTokenHandler(token);
   return new azdev.WebApi(orgUrl, authHandler);

package/src/utils/intOption.js

@@ -0,0 +1,18 @@
+import { InvalidArgumentError } from 'commander';
+
+/**
+ * Commander parser for an integer option within [min, max]. Commander passes the
+ * option's default as the parser's second argument, so a bare `parseInt` would
+ * use it as the radix (`--limit 30` with default 20 → 60).
+ */
+export function intOption({ min = 0, max = Infinity } = {}) {
+  return (value) => {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < min || n > max) {
+      throw new InvalidArgumentError(
+        max === Infinity ? `Must be an integer of at least ${min}.` : `Must be an integer from ${min} to ${max}.`
+      );
+    }
+    return n;
+  };
+}

package/src/utils/loginFlow.js

@@ -4,6 +4,7 @@ import { getBaseUrl, getDashboardUrl } from './baseUrl.js';
 
 const DEFAULT_POLL_INTERVAL = 10_000;
 const DEFAULT_TIMEOUT = 10 * 60 * 1000;
+const BROWSER_SPAWN_TIMEOUT = 2_000;
 
 export function isAlreadyLoggedIn() {
   return !!getConfigValue('apiKeyV2');
@@ -16,16 +17,24 @@ export async function startLoginFlow() {
   const loginUrl = `${dashboardUrl}?ideLoginToken=${token}`;
   const pollUrl = `${baseUrl}/extension/login/status?apiKey=${token}`;
 
-  let browserOpened = false;
+  const browserOpened = await openBrowser(loginUrl);
+  return { token, loginUrl, pollUrl, browserOpened };
+}
+
+// `open` returns the launcher process without an 'error' listener, so a missing
+// launcher (SSH, containers) would otherwise crash the MCP server.
+async function openBrowser(url) {
   try {
     const { default: open } = await import('open');
-    await open(loginUrl);
-    browserOpened = true;
+    const child = await open(url);
+    return await new Promise((resolve) => {
+      child.once('error', () => resolve(false));
+      child.once('spawn', () => resolve(true));
+      setTimeout(() => resolve(true), BROWSER_SPAWN_TIMEOUT).unref?.();
+    });
   } catch {
-    // Caller can fall back to printing loginUrl.
+    return false;
   }
-
-  return { token, loginUrl, pollUrl, browserOpened };
 }
 
 export async function awaitLoginCompletion({
@@ -47,29 +56,26 @@ export async function awaitLoginCompletion({
     try {
       const response = await fetch(pollUrl);
       const data = await response.json();
-      if (data.status === 'yes') {
+      // Do not save the token if the login was aborted while this poll was in flight.
+      if (data.status === 'yes' && !signal?.aborted) {
         setConfigValue('apiKeyV2', token);
-        process.env.CODEANT_API_TOKEN = token;
         return { ok: true, token };
       }
     } catch {
       // Network blip — keep polling.
     }
 
+    if (signal?.aborted) throw new Error('Login aborted');
+
     const remaining = deadline - Date.now();
     if (remaining <= 0) break;
-    await new Promise((resolve) => setTimeout(resolve, Math.min(pollIntervalMs, remaining)));
+    await new Promise((resolve) => {
+      const onAbort = () => { clearTimeout(timer); resolve(); };
+      const timer = setTimeout(() => { signal?.removeEventListener('abort', onAbort); resolve(); }, Math.min(pollIntervalMs, remaining));
+      signal?.addEventListener('abort', onAbort, { once: true });
+    });
   }
 
+  if (signal?.aborted) throw new Error('Login aborted');
   throw new Error('Login timed out. Please try again.');
 }
-
-export async function runLoginFlow({
-  pollIntervalMs = DEFAULT_POLL_INTERVAL,
-  timeoutMs = DEFAULT_TIMEOUT,
-  signal,
-} = {}) {
-  const { token, loginUrl, pollUrl, browserOpened } = await startLoginFlow();
-  const result = await awaitLoginCompletion({ token, pollUrl, pollIntervalMs, timeoutMs, signal });
-  return { ...result, loginUrl, browserOpened };
-}