codeant-cli 0.5.8 → 0.5.9

package/findings.md

@@ -49,9 +49,9 @@ codeant findings repo \
   --output codeant.sarif
 ```
 
-Supported repo types are `sast`, `sca`, `secrets`, `iac`, `dead_code`, `sbom`, `anti_patterns`, `docstring`, and `complex_functions`. Use `--types all` for all of them. Formats are `json`, `sarif`, `csv`, `md`, and `table`; JSON is the default.
+Supported repo types are `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, and `complex_functions`. Use `--types all` for all of them. Formats are `json`, `sarif`, `csv`, `md`, and `table`; JSON is the default.
 
-Use `--filter-dismissed` to exclude dismissed findings and `--no-false-positives` to exclude false positives. `--path`, `--check`, `--limit`, and `--offset` support agent-friendly filtering and pagination.
+Use `--filter-dismissed` to exclude dismissed findings and `--no-false-positives` to exclude false positives, including ones users marked in the app. Without those flags, such findings are returned with `metadata.dismissed` or `metadata.false_positive`. `--path`, `--check`, `--limit`, and `--offset` support agent-friendly filtering and pagination.
 
 ## Organization Hotlist findings
 

package/mcp.md

@@ -15,7 +15,8 @@ The CodeAnt CLI ships an MCP (Model Context Protocol) server that exposes CodeAn
 | `codeant_scans_history` | read | Recent scan runs for a repo. |
 | `codeant_scans_get` | read | Severity/category summary for one scan. |
 | `codeant_scans_results` | read | Full findings (SAST, SCA, secrets, IaC, …) for one scan. |
-| `codeant_scans_dismissed` | read | Dismissed alerts for a repo. |
+| `codeant_scans_dismissed` | read | Dismissed alerts for a repo (any analysis type; `sast` and `anti_patterns` are accepted as aliases). |
+| `codeant_scans_overrides` | read | User false-positive, confidence, and severity overrides for a repo. |
 | `codeant_hotlist_list` | read | Prioritized organization-wide Hotlist findings with stable IDs. |
 | `codeant_hotlist_get` | read | One complete Hotlist finding by stable ID. |
 | `codeant_findings_antipatterns` | read | Anti-pattern findings across selected or all organization repos (paged: `limit`, `offset`, `all`). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "Code review CLI tool",
   "type": "module",
   "repository": {
@@ -36,6 +36,7 @@
     "./scans/fetch-results": "./src/scans/fetchScanResults.js",
     "./scans/fetch-advanced-results": "./src/scans/fetchAdvancedScanResults.js",
     "./scans/dismissed-alerts": "./src/scans/fetchDismissedAlerts.js",
+    "./scans/issue-overrides": "./src/scans/fetchIssueOverrides.js",
     "./hotlist": "./src/hotlist/client.js",
     "./findings/cloud": "./src/findings/cloud.js",
     "./findings/pentest": "./src/findings/pentest.js",

package/scans.md

@@ -135,11 +135,12 @@ codeant scans results --repo <owner/repo> [options]
 | `--repo <repo>` | **(required)** Repository in `owner/repo` format |
 | `--scan <sha>` | Specific commit SHA to use |
 | `--branch <name>` | Resolve latest scan on this branch |
-| `--types <list>` | Comma-separated types: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all` (default: `all`) |
+| `--types <list>` | Comma-separated types: `sast`, `sca`, `secrets`, `iac`, `dead_code`, `duplicate_code`, `sbom`, `anti_patterns`, `docstring`, `complex_functions`, `all` (default: `all`) |
 | `--severity <list>` | Filter by severity (e.g. `critical,high`) |
 | `--path <glob>` | Filter by file path glob |
 | `--check <regex>` | Filter by check ID or name (regex) |
-| `--include-dismissed` | Include dismissed findings (excluded by default) |
+| `--filter-dismissed` | Exclude dismissed findings (included by default, marked `metadata.dismissed`) |
+| `--no-false-positives` | Exclude false positives, including ones users marked in the app (included by default, marked `metadata.false_positive`) |
 | `--format <fmt>` | Output format: `json`, `sarif`, `csv`, `md`, `table` (default: `json`) |
 | `--output <path>` | Write output to file instead of stdout |
 | `--fields <list>` | Project findings to a subset of fields (comma-separated) |
@@ -173,8 +174,8 @@ codeant scans results --repo acme/backend --format md
 # Output as SARIF to a file
 codeant scans results --repo acme/backend --format sarif --output results.sarif
 
-# Include dismissed findings
-codeant scans results --repo acme/backend --include-dismissed
+# Only open findings: drop dismissed findings and false positives
+codeant scans results --repo acme/backend --filter-dismissed --no-false-positives
 
 # Paginate through results
 codeant scans results --repo acme/backend --limit 50 --offset 100
@@ -206,7 +207,7 @@ codeant scans dismissed --repo <owner/repo> [options]
 | Option | Description |
 |--------|-------------|
 | `--repo <repo>` | **(required)** Repository in `owner/repo` format |
-| `--analysis-type <type>` | Analysis type: `security` or `secrets` (default: `security`) |
+| `--analysis-type <type>` | `security`, `secrets`, `sca`, `iac`, `antipatterns`, `docstring`, `complex_functions`, `dead_code`, or `duplicate_code` (default: `security`). Result-type names `sast` and `anti_patterns` are accepted too. |
 
 **Examples:**
 
@@ -220,6 +221,16 @@ codeant scans dismissed --repo acme/backend --analysis-type secrets
 
 ---
 
+### `scans overrides`
+
+List the per-finding overrides users set in the CodeAnt app: Mark/Unmark false positive (`security`, `iac`), secrets confidence (`secrets`), and Change Severity (`security`, `sca`). `scans results` already applies them.
+
+```bash
+codeant scans overrides --repo <owner/repo> [--analysis-type security|secrets|iac|sca]
+```
+
+---
+
 ### `scans start-scan`
 
 Trigger a new analysis run for a repository.

package/src/commands/scans/dismissed.js

@@ -1,16 +1,34 @@
 import { fetchDismissedAlerts } from '../../scans/fetchDismissedAlerts.js';
+import { fetchIssueOverrides } from '../../scans/fetchIssueOverrides.js';
 
-/**
- * codeant scans dismissed --repo <repo> [--analysis-type security|secrets]
- */
-export async function runDismissed({ repo, analysisType = 'security' } = {}) {
+// Result-type names (`scans results --types`) → the names dismissals and
+// overrides are stored under.
+const STORE_ANALYSIS_TYPES = {
+  sast: 'security',
+  security_issues: 'security',
+  anti_patterns: 'antipatterns',
+};
+
+export function storeAnalysisType(analysisType) {
+  return STORE_ANALYSIS_TYPES[analysisType] || analysisType;
+}
+
+function requireRepo(repo) {
   if (!repo) {
     const err = new Error('--repo is required');
     err.exitCode = 1;
     throw err;
   }
+}
+
+/**
+ * codeant scans dismissed --repo <repo> [--analysis-type <type>]
+ */
+export async function runDismissed({ repo, analysisType = 'security' } = {}) {
+  requireRepo(repo);
+  const type = storeAnalysisType(analysisType);
 
-  const result = await fetchDismissedAlerts(repo, analysisType);
+  const result = await fetchDismissedAlerts(repo, type);
   if (!result.success) {
     const err = new Error(result.error || 'Failed to fetch dismissed alerts');
     err.exitCode = 1;
@@ -19,8 +37,30 @@ export async function runDismissed({ repo, analysisType = 'security' } = {}) {
 
   return {
     repo,
-    analysis_type: analysisType,
+    analysis_type: type,
     total: result.dismissedAlerts.length,
     dismissed_alerts: result.dismissedAlerts,
   };
 }
+
+/**
+ * codeant scans overrides --repo <repo> [--analysis-type security|secrets|iac|sca]
+ */
+export async function runOverrides({ repo, analysisType = 'security' } = {}) {
+  requireRepo(repo);
+  const type = storeAnalysisType(analysisType);
+
+  const result = await fetchIssueOverrides(repo, type);
+  if (!result.success) {
+    const err = new Error(result.error || 'Failed to fetch issue overrides');
+    err.exitCode = 1;
+    throw err;
+  }
+
+  return {
+    repo,
+    analysis_type: type,
+    total: Object.keys(result.overrides).length,
+    overrides: result.overrides,
+  };
+}

package/src/commands/scans/index.js

@@ -3,10 +3,14 @@ import { runRepos } from './repos.js';
 import { runHistory } from './history.js';
 import { runGet } from './get.js';
 import { runResults } from './results.js';
-import { runDismissed } from './dismissed.js';
+import { runDismissed, runOverrides } from './dismissed.js';
 import { runStartScan } from './start-scan.js';
 import { setQuiet, setNoColor } from './lib/log.js';
 import { setNoColor as tableSetNoColor } from './formatters/table.js';
+import { intOption } from '../../utils/intOption.js';
+
+const toCount = intOption({ min: 1 });
+const toOffset = intOption();
 
 /**
  * Register all `codeant scans <verb>` subcommands.
@@ -37,7 +41,7 @@ export default function registerScansCommands(program, { runCmd }) {
     .requiredOption('--repo <repo>', 'Repository (owner/repo)')
     .option('--branch <name>', 'Filter by branch name')
     .option('--since <iso>', 'Show scans since ISO date')
-    .option('--limit <n>', 'Max results (default: 20)', parseInt, 20)
+    .option('--limit <n>', 'Max results (default: 20)', toCount, 20)
     .action((opts) =>
       runCmd(() => runHistory({ repo: opts.repo, branch: opts.branch, since: opts.since, limit: opts.limit }))
     );
@@ -65,7 +69,7 @@ export default function registerScansCommands(program, { runCmd }) {
     .option('--branch <name>', 'Resolve latest scan on this branch')
     .option(
       '--types <list>',
-      'Comma-separated types: sast,sca,secrets,iac,dead_code,sbom,anti_patterns,docstring,complex_functions,all',
+      'Comma-separated types: sast,sca,secrets,iac,dead_code,duplicate_code,sbom,anti_patterns,docstring,complex_functions,all',
       'all'
     )
     .option('--severity <list>', 'Filter by severity (e.g. critical,high)')
@@ -76,8 +80,8 @@ export default function registerScansCommands(program, { runCmd }) {
     .option('--format <fmt>', 'Output format: json|sarif|csv|md|table (default: json)', 'json')
     .option('--output <path>', 'Write output to file instead of stdout')
     .option('--fields <list>', 'Project findings to subset of fields (comma-separated)')
-    .option('--limit <n>', 'Max findings per page (default: 100)', parseInt, 100)
-    .option('--offset <n>', 'Pagination offset (default: 0)', parseInt, 0)
+    .option('--limit <n>', 'Max findings per page (default: 100)', toCount, 100)
+    .option('--offset <n>', 'Pagination offset (default: 0)', toOffset, 0)
     .option('--fail-fast', 'Exit 3 on first category fetch failure')
     .option('--no-color', 'Disable ANSI color (auto-disabled when not a TTY)')
     .option('--quiet', 'Suppress progress output on stderr')
@@ -117,11 +121,25 @@ export default function registerScansCommands(program, { runCmd }) {
     .command('dismissed')
     .description('List dismissed alerts for a repository')
     .requiredOption('--repo <repo>', 'Repository (owner/repo)')
-    .option('--analysis-type <type>', 'Analysis type: security|secrets (default: security)', 'security')
+    .option(
+      '--analysis-type <type>',
+      'Analysis type: security|secrets|sca|iac|antipatterns|docstring|complex_functions|dead_code|duplicate_code (default: security)',
+      'security'
+    )
     .action((opts) =>
       runCmd(() => runDismissed({ repo: opts.repo, analysisType: opts.analysisType }))
     );
 
+  // ── overrides ──────────────────────────────────────────────────────────────
+  scans
+    .command('overrides')
+    .description('List user overrides (false positive, confidence, severity) for a repository')
+    .requiredOption('--repo <repo>', 'Repository (owner/repo)')
+    .option('--analysis-type <type>', 'Analysis type: security|secrets|iac|sca (default: security)', 'security')
+    .action((opts) =>
+      runCmd(() => runOverrides({ repo: opts.repo, analysisType: opts.analysisType }))
+    );
+
   // ── start-scan ─────────────────────────────────────────────────────────────
   scans
     .command('start-scan')

package/src/commands/scans/lib/categories.js

@@ -10,6 +10,7 @@ import {
   fetchSecretsResults,
   fetchIacResults,
   fetchDeadCodeResults,
+  fetchDuplicateCodeResults,
 } from '../../../scans/fetchAdvancedScanResults.js';
 
 /**
@@ -26,6 +27,7 @@ export const CATEGORIES = {
   secrets:           { fetcher: fetchSecretsResults,          kind: 'secret' },
   iac:               { fetcher: fetchIacResults,              kind: 'config' },
   dead_code:         { fetcher: fetchDeadCodeResults,         kind: 'code' },
+  duplicate_code:    { fetcher: fetchDuplicateCodeResults,    kind: 'code' },
 };
 
 /**

package/src/commands/scans/lib/normalize.js

@@ -87,6 +87,20 @@ export function normalizeIssue(issue, category) {
   } else if (category === 'sca') {
     if (issue.cvss_score !== undefined) metadata.cvss_score = issue.cvss_score;
     if (issue.fix_version) metadata.fix_version = issue.fix_version;
+  } else if (category === 'duplicate_code') {
+    if (issue.duplicate_group !== undefined) metadata.duplicate_group = issue.duplicate_group;
+    if (issue.duplicate_locations) metadata.duplicate_locations = issue.duplicate_locations;
+  }
+
+  // Backend dispositions, present when dismissed / false positives are not filtered out.
+  if (issue.is_dismissed === true) {
+    metadata.dismissed = true;
+    if (issue.reason_for_dismiss) metadata.reason_for_dismiss = issue.reason_for_dismiss;
+    if (issue.comment_for_dismiss) metadata.comment_for_dismiss = issue.comment_for_dismiss;
+  }
+  // Secrets from older backends only carry the FALSE_POSITIVE confidence.
+  if (issue.is_false_positive === true || String(issue.confidence_score || '').toUpperCase() === 'FALSE_POSITIVE') {
+    metadata.false_positive = true;
   }
 
   const id = buildId(category, filePath, lineNumber, checkId, message);

package/src/index.js

@@ -20,6 +20,7 @@ import ScanCenter from './components/ScanCenter.js';
 import Welcome from './components/Welcome.js';
 import * as scm from './scm/index.js';
 import { setConfigValue } from './utils/config.js';
+import { intOption } from './utils/intOption.js';
 import { track, shutdown as analyticsShutdown, isTelemetryDisabled } from './utils/analytics.js';
 import registerScansCommands from './commands/scans/index.js';
 import registerSettingsCommands from './commands/settings/index.js';
@@ -31,6 +32,9 @@ import registerFindingsCommands from './commands/findings/index.js';
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
 
+const toCount = intOption({ min: 1 });
+const toOffset = intOption();
+
 // Split comma-separated globs while preserving commas inside {} brace expansions (e.g. "*.{js,ts}")
 function splitGlobs(input) {
   const parts = [];
@@ -67,7 +71,7 @@ program
   .option('--uncommitted', 'Scan only uncommitted changes (staged + unstaged + untracked)')
   .option('--staged', 'Scan only staged files')
   .option('--last-commit', 'Scan last commit')
-  .option('--last-n-commits <n>', 'Scan last n commits (max 5)', parseInt)
+  .option('--last-n-commits <n>', 'Scan last n commits (max 5)', toCount)
   .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
   .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
@@ -118,7 +122,7 @@ program
   .option('--uncommitted', 'Review only uncommitted changes (staged + unstaged + untracked)')
   .option('--staged', 'Review only staged files')
   .option('--last-commit', 'Review last commit')
-  .option('--last-n-commits <n>', 'Review last n commits (max 5)', parseInt)
+  .option('--last-n-commits <n>', 'Review last n commits (max 5)', toCount)
   .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
   .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
   .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
@@ -299,8 +303,8 @@ program
     .option('--source-branch <branch>', 'Filter by source branch (partial match)')
     .option('--author <login>', 'Filter by author (fuzzy match)')
     .option('--state <state>', 'open or closed (default: open)', 'open')
-    .option('--limit <n>', 'Max results (default: 20, max: 100)', parseInt, 20)
-    .option('--offset <n>', 'Pagination offset', parseInt, 0)
+    .option('--limit <n>', 'Max results (default: 20, max: 100)', intOption({ min: 1, max: 100 }), 20)
+    .option('--offset <n>', 'Pagination offset', toOffset, 0)
     .action((options) => {
       const opts = resolveRepoOpts(options);
       runCmd(() => scm.listPullRequests({
@@ -315,7 +319,7 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .option('--default-branch <branch>', 'Default branch name')
-    .requiredOption('--pr-number <n>', 'PR number', parseInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
     .action((options) => {
       const opts = resolveRepoOpts(options);
       runCmd(() => scm.getPullRequest({
@@ -329,7 +333,7 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .option('--default-branch <branch>', 'Default branch name')
-    .requiredOption('--pr-number <n>', 'PR number', parseInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
     .option('--codeant-generated <bool>', 'Filter by CodeAnt authorship (true/false)', (v) => v === 'true')
     .option('--addressed', 'Filter by addressed/resolved status')
     .option('--created-after <date>', 'ISO 8601 date filter')
@@ -347,8 +351,8 @@ program
     .description('Resolve a conversation/comment thread on a PR')
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
-    .requiredOption('--pr-number <n>', 'PR number', parseInt)
-    .option('--comment-id <id>', 'Comment ID (GitHub, Bitbucket)', parseInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
+    .option('--comment-id <id>', 'Comment ID (GitHub, Bitbucket)', toCount)
     .option('--thread-id <id>', 'Thread/node ID (GitHub GraphQL, Azure)')
     .option('--discussion-id <id>', 'Discussion ID (GitLab)')
     .action((options) => {
@@ -370,10 +374,10 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .option('--default-branch <branch>', 'Default branch name')
-    .option('--pr-number <n>', 'Filter by PR number', parseInt)
+    .option('--pr-number <n>', 'Filter by PR number', toCount)
     .option('--status <status>', 'Filter by status (PENDING, COMPLETED, FAILED, etc.)')
-    .option('--limit <n>', 'Max results (default: 20)', parseInt, 20)
-    .option('--offset <n>', 'Pagination offset', parseInt, 0)
+    .option('--limit <n>', 'Max results (default: 20)', toCount, 20)
+    .option('--offset <n>', 'Pagination offset', toOffset, 0)
     .action((options) => {
       const opts = resolveRepoOpts(options);
       runCmd(() => scm.listCodeReviews({
@@ -387,7 +391,7 @@ program
     .description('Get detailed information for a specific code review')
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
-    .requiredOption('--pr-number <n>', 'PR number', parseInt)
+    .requiredOption('--pr-number <n>', 'PR number', toCount)
     .requiredOption('--review-id <id>', 'Code review ID')
     .action((options) => {
       const opts = resolveRepoOpts(options);
@@ -405,7 +409,7 @@ program
     .option('--name <repo>', 'Repository (owner/repo)')
     .option('--remote <provider>', 'github, gitlab, bitbucket, azure')
     .requiredOption('--query <term>', 'Search term')
-    .option('--limit <n>', 'Max results (default: 10, max: 50)', parseInt, 10)
+    .option('--limit <n>', 'Max results (default: 10, max: 50)', intOption({ min: 1, max: 50 }), 10)
     .option('--include-addressed', 'Include resolved comments (default: false)')
     .option('--created-after <date>', 'ISO 8601 date filter')
     .action((options) => {

package/src/mcp/server.js

@@ -8,7 +8,7 @@ import { runRepos } from '../commands/scans/repos.js';
 import { runHistory } from '../commands/scans/history.js';
 import { runGet } from '../commands/scans/get.js';
 import { runResults } from '../commands/scans/results.js';
-import { runDismissed } from '../commands/scans/dismissed.js';
+import { runDismissed, runOverrides } from '../commands/scans/dismissed.js';
 import { runStartScan } from '../commands/scans/start-scan.js';
 import { runReviewHeadless } from '../reviewHeadless.js';
 import * as scm from '../scm/index.js';
@@ -164,12 +164,12 @@ export async function startMcpServer() {
         repo: z.string().describe('Repository in owner/repo form.'),
         scan: z.string().optional().describe('Specific commit SHA.'),
         branch: z.string().optional().describe('Resolve the latest scan on this branch.'),
-        types: z.string().optional().describe('Comma-separated types: sast,sca,secrets,iac,dead_code,sbom,anti_patterns,docstring,complex_functions,all (default "all").'),
+        types: z.string().optional().describe('Comma-separated types: sast,sca,secrets,iac,dead_code,duplicate_code,sbom,anti_patterns,docstring,complex_functions,all (default "all").'),
         severity: z.string().optional().describe('Comma-separated severities (e.g. "critical,high").'),
         path: z.string().optional().describe('File path glob filter.'),
         check: z.string().optional().describe('Filter by check ID or name (regex).'),
-        filterDismissed: z.boolean().optional().describe('Exclude dismissed findings (default false).'),
-        includeFalsePositives: z.boolean().optional().describe('Include false positives (default true).'),
+        filterDismissed: z.boolean().optional().describe('Exclude dismissed findings (default false). When false, dismissed findings carry metadata.dismissed.'),
+        includeFalsePositives: z.boolean().optional().describe('Include false positives, including user-marked ones (default true). When true, they carry metadata.false_positive.'),
         fields: z.string().optional().describe('Project findings to a subset of fields (comma-separated).'),
         limit: z.number().int().positive().max(500).optional().describe('Max findings per page (default 100).'),
         offset: z.number().int().nonnegative().optional().describe('Pagination offset (default 0).'),
@@ -212,7 +212,7 @@ export async function startMcpServer() {
       description: 'List dismissed alerts (false positives, accepted risk, etc.) for a repository. Useful when triaging to avoid re-surfacing already-handled findings.',
       inputSchema: {
         repo: z.string().describe('Repository in owner/repo form.'),
-        analysisType: z.enum(['security', 'secrets']).optional().describe('Analysis type (default "security").'),
+        analysisType: z.enum(['security', 'sast', 'secrets', 'sca', 'iac', 'antipatterns', 'anti_patterns', 'docstring', 'complex_functions', 'dead_code', 'duplicate_code']).optional().describe('Analysis type (default "security"; sast and anti_patterns are aliases).'),
       },
       annotations: READ,
     },
@@ -221,6 +221,22 @@ export async function startMcpServer() {
     }
   );
 
+  server.registerTool(
+    'codeant_scans_overrides',
+    {
+      title: 'List user issue overrides',
+      description: 'List per-finding overrides users set in the CodeAnt app for a repository: Mark/Unmark false positive (security, iac), secrets confidence, and Change Severity (security, sca). Results from codeant_scans_results already apply them; use this to explain why a finding is hidden or re-rated.',
+      inputSchema: {
+        repo: z.string().describe('Repository in owner/repo form.'),
+        analysisType: z.enum(['security', 'secrets', 'iac', 'sca']).optional().describe('Analysis type (default "security").'),
+      },
+      annotations: READ,
+    },
+    async ({ repo, analysisType }) => {
+      try { return ok(await runOverrides({ repo, analysisType: analysisType ?? 'security' })); } catch (err) { return fail(err); }
+    }
+  );
+
   // ─── Organization Hotlist findings (read-only) ──────────────────────────
   server.registerTool(
     'codeant_hotlist_list',

package/src/scans/fetchAdvancedScanResults.js

@@ -6,8 +6,23 @@ export const ADVANCED_RESULT_TYPES = {
   SECRETS: 'secrets',
   IAC: 'iac',
   DEAD_CODE: 'dead_code',
+  DUPLICATE_CODE: 'duplicate_code',
 };
 
+const BACKEND_MARKERS = ['is_dismissed', 'reason_for_dismiss', 'comment_for_dismiss', 'is_false_positive'];
+
+/**
+ * Dismissed / false-positive markers the backend stamps on each finding. Kept
+ * when a finding is rebuilt so callers can hide or show those findings.
+ */
+function backendMarkers(item) {
+  const markers = {};
+  for (const key of BACKEND_MARKERS) {
+    if (item?.[key] !== undefined) markers[key] = item[key];
+  }
+  return markers;
+}
+
 const EXTRA_DEAD_CODE_MESSAGES = {
   S1481: 'Unused local variable',
   S1854: 'Unused assignment',
@@ -74,12 +89,16 @@ function flattenDeadCode(deadCodeData) {
         name,
         confidence: confMatch ? confMatch[1] : '90',
         check_name: `Unused ${issueType}: ${name}`,
+        ...backendMarkers(issue),
       });
     });
   });
 
-  // JS dead code — unused files
+  // JS dead code — unused files (plain path strings; the backend lists dismissed ones separately)
   const jsDeadCode = deadCodeData.js_dead_code || {};
+  const dismissedFiles = Array.isArray(jsDeadCode.dismissed_unused_files)
+    ? new Set(jsDeadCode.dismissed_unused_files)
+    : null;
   (jsDeadCode.unused_files || []).forEach((filePath) => {
     if (!filePath) return;
     flat.push({
@@ -90,6 +109,7 @@ function flattenDeadCode(deadCodeData) {
       severity: 'warning',
       type: 'unused_file',
       check_name: 'Unused file',
+      ...(dismissedFiles ? { is_dismissed: dismissedFiles.has(filePath) } : {}),
     });
   });
 
@@ -110,6 +130,7 @@ function flattenDeadCode(deadCodeData) {
         type: 'unused_export',
         name: exp.name,
         check_name: `Unused export: ${exp.name || 'unknown'}`,
+        ...backendMarkers(exp),
       });
     });
   });
@@ -124,7 +145,8 @@ function flattenDeadCode(deadCodeData) {
         const messageId = issue['message-id'] || '';
         const msgKey = messageId.includes(':') ? messageId.split(':')[1] : messageId;
         flat.push({
-          file_path: extractRelativeFilePath(filePath),
+          // Keys end with the per-file result name (".../app.py/dead_code.json").
+          file_path: extractRelativeFilePath(filePath).replace(/\/[^/]+\.json$/, ''),
           line_number: issue.line_number || 0,
           issue_text: issue.issue_text || EXTRA_DEAD_CODE_MESSAGES[msgKey] || 'Dead code detected',
           message: issue.issue_text || EXTRA_DEAD_CODE_MESSAGES[msgKey] || 'Dead code detected',
@@ -133,6 +155,7 @@ function flattenDeadCode(deadCodeData) {
           rule_id: msgKey,
           confidence: issue.confidence || '90',
           check_name: EXTRA_DEAD_CODE_MESSAGES[msgKey] || 'Dead code detected',
+          ...backendMarkers(issue),
         });
       });
     });
@@ -141,6 +164,49 @@ function flattenDeadCode(deadCodeData) {
   return flat;
 }
 
+/** "[12-40]" → [12, 40]; anything unparsable → []. */
+function parseWindow(window) {
+  const numbers = String(window ?? '').match(/\d+/g) || [];
+  return numbers.slice(0, 2).map(Number);
+}
+
+/**
+ * Flatten duplicate-code clone groups (each a list of { fileName, window }
+ * members) into one finding per member, linked by their group index.
+ */
+function flattenDuplicateCode(groups) {
+  if (!Array.isArray(groups)) return [];
+  const flat = [];
+  groups.forEach((group, groupIndex) => {
+    const members = Array.isArray(group) ? group.filter((m) => m && typeof m === 'object') : [];
+    const locations = members.map((m) => {
+      const [start, end] = parseWindow(m.window);
+      return { file_path: extractRelativeFilePath(cleanLeadingSlash(m.fileName)), start, end };
+    });
+    members.forEach((member, i) => {
+      const { file_path, start, end } = locations[i];
+      const others = locations
+        .filter((_, j) => j !== i)
+        .map((o) => (o.start ? `${o.file_path}:${o.start}${o.end ? `-${o.end}` : ''}` : o.file_path));
+      const message = `Duplicated block (${members.length} locations)`;
+      flat.push({
+        file_path,
+        line_number: start || 1,
+        file_line_range: end ? [start, end] : [start || 1],
+        check_id: 'duplicate-code',
+        check_name: message,
+        issue_text: message,
+        message,
+        severity: 'low',
+        duplicate_group: member.originalIndex ?? groupIndex,
+        duplicate_locations: others,
+        ...backendMarkers(member),
+      });
+    });
+  });
+  return flat;
+}
+
 /**
  * Normalize a single advanced issue to a consistent shape.
  */
@@ -163,7 +229,8 @@ function normalizeAdvancedIssue(item, resultType) {
         item.vulnerability_id || item.cve_id || item.advisory_id ||
         (item.package_name ? `Vulnerability in ${item.package_name}` : null) ||
         item.title || item.description || 'Package vulnerability detected';
-      normalized.severity = item.severity || 'medium';
+      // SCA findings carry severity in ratings (where Change Severity overrides land).
+      normalized.severity = item.severity || item.ratings?.[0]?.severity || 'medium';
       break;
     case ADVANCED_RESULT_TYPES.SBOM:
       normalized.check_name = item.package_name
@@ -187,6 +254,10 @@ function normalizeAdvancedIssue(item, resultType) {
         item.check_name || item.name || item.function_name || item.symbol_name || item.description || 'Unused code detected';
       normalized.severity = item.severity || 'low';
       break;
+    case ADVANCED_RESULT_TYPES.DUPLICATE_CODE:
+      normalized.check_name = item.check_name || 'Duplicated block';
+      normalized.severity = item.severity || 'low';
+      break;
     default:
       normalized.check_name = item.description || item.message || item.name || 'Issue detected';
   }
@@ -195,7 +266,7 @@ function normalizeAdvancedIssue(item, resultType) {
 }
 
 /**
- * Fetch advanced scan results (SCA, SBOM, secrets, IaC, dead code).
+ * Fetch advanced scan results (SCA, SBOM, secrets, IaC, dead code, duplicate code).
  *
  * @param {string} repo       - "org/repo-name"
  * @param {string} commitId   - 40-char commit SHA
@@ -237,6 +308,8 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType, opts
       resultsData = response.secrets;
     } else if (resultType === ADVANCED_RESULT_TYPES.DEAD_CODE) {
       resultsData = flattenDeadCode(response.dead_code);
+    } else if (resultType === ADVANCED_RESULT_TYPES.DUPLICATE_CODE) {
+      resultsData = flattenDuplicateCode(response.results);
     } else if (resultType === ADVANCED_RESULT_TYPES.SCA) {
       const scaResults = response.results;
       if (scaResults && typeof scaResults === 'object' && !Array.isArray(scaResults) && scaResults.all_vulnerabilities !== undefined) {
@@ -268,6 +341,7 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType, opts
                 guideline: check.guideline || '',
                 code_block: check.code_block || [],
                 resource: check.resource || '',
+                ...backendMarkers(check),
               });
             });
           });
@@ -328,3 +402,6 @@ export const fetchIacResults = (repo, commitId, opts) =>
 
 export const fetchDeadCodeResults = (repo, commitId, opts) =>
   fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DEAD_CODE, opts);
+
+export const fetchDuplicateCodeResults = (repo, commitId, opts) =>
+  fetchAdvancedScanResults(repo, commitId, ADVANCED_RESULT_TYPES.DUPLICATE_CODE, opts);

package/src/scans/fetchDismissedAlerts.js

@@ -29,7 +29,21 @@ export async function fetchDismissedAlerts(repo, analysisType = 'security') {
     const dismissedAlerts = [];
 
     for (const [issueKey, dismissInfo] of Object.entries(dismissData)) {
-      if (!issueKey.includes('||::||')) continue;
+      if (!issueKey.includes('||::||')) {
+        // SCA ("pkg@version[::manifest::cve]") and duplicate-code (group index)
+        // keys have no file/line parts; keep them so the count is complete.
+        dismissedAlerts.push({
+          file_path: '',
+          context_code_block: '',
+          test_id: '',
+          line_number: 0,
+          type: '',
+          issue_key: issueKey,
+          reason_for_dismiss: dismissInfo?.reason_for_dismiss || '',
+          comment_for_dismiss: dismissInfo?.comment_for_dismiss || '',
+        });
+        continue;
+      }
 
       const parts = issueKey.split('||::||');
       let file_path = parts[0] || '';

package/src/scans/fetchIssueOverrides.js

@@ -0,0 +1,36 @@
+import { fetchApi } from '../utils/fetchApi.js';
+
+/**
+ * Fetch the per-finding user overrides the web app saves for a repository
+ * (Mark/Unmark false positive, secrets confidence, Change Severity).
+ *
+ * Override keys and patches by analysis type:
+ *   security — "id::<tracking id>|rule::<test_id>||::||<result key>||::||<line>" → { false_positive, severity }
+ *   secrets  — "<path>||::||<hashed_secret or line>||::||<type>"               → { confidence_score }
+ *   iac      — "<file_path>||::||<check_id>||::||<start>-<end>"                → { false_positive }
+ *   sca      — "<package>@<version>"                                           → { severity }
+ *
+ * @param {string} repo         - "org/repo-name"
+ * @param {string} analysisType - security | secrets | iac | sca
+ * @returns {Promise<{ success: boolean, overrides?: Object, error?: string }>}
+ */
+export async function fetchIssueOverrides(repo, analysisType) {
+  try {
+    const response = await fetchApi('/extension/scans2/change-issue-details/get', 'POST', {
+      repo,
+      analysis_type: analysisType,
+    });
+
+    if (!response) {
+      return { success: false, error: 'Failed to connect to CodeAnt server' };
+    }
+
+    if (response.status === 'error') {
+      return { success: false, error: response.message || 'Failed to fetch issue overrides' };
+    }
+
+    return { success: true, overrides: response.data || {} };
+  } catch (error) {
+    return { success: false, error: error.message || 'Failed to fetch issue overrides' };
+  }
+}

package/src/scans/fetchScanResults.js

@@ -70,7 +70,6 @@ export async function fetchScanResults(repo, commitId, resultType, opts = {}) {
       filter_dismissed: filterDismissed,
       include_false_positives: includeFalsePositives,
     });
-    console.error("dropship: ", JSON.stringify(response, null, 2));
 
     if (!response) {
       return { success: false, error: 'Failed to connect to CodeAnt server' };

package/src/utils/intOption.js

@@ -0,0 +1,18 @@
+import { InvalidArgumentError } from 'commander';
+
+/**
+ * Commander parser for an integer option within [min, max]. Commander passes the
+ * option's default as the parser's second argument, so a bare `parseInt` would
+ * use it as the radix (`--limit 30` with default 20 → 60).
+ */
+export function intOption({ min = 0, max = Infinity } = {}) {
+  return (value) => {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < min || n > max) {
+      throw new InvalidArgumentError(
+        max === Infinity ? `Must be an integer of at least ${min}.` : `Must be an integer from ${min} to ${max}.`
+      );
+    }
+    return n;
+  };
+}