Address CLI history and scan review feedback

Author: pranavcodeant

.gitignore

@@ -33,3 +33,6 @@ coverage/
 
 # Shell scripts
 *.sh
+
+# Local Codex connection settings can contain credentials.
+.codex/

mcpb/manifest.json

@@ -4,7 +4,7 @@
   "display_name": "CodeAnt AI",
   "version": "0.5.3",
   "description": "Drive CodeAnt AI security scans and code review from Claude \u2014 org-wide secret triage, cross-repo SAST/SCA findings, on-demand scans, and local PR review.",
-  "long_description": "CodeAnt AI inside Claude. Ask things like \"show my highest-priority Hotlist findings\", \"list AWS cloud findings\", \"show this pentest report\", or \"review my staged changes\" \u2014 Claude calls the CodeAnt API directly via this MCP server.\n\nIncludes 22 read-only tools, covering repository, Hotlist, cloud security, anti-pattern, and pentest findings plus an authenticated GET escape hatch for new APIs, 2 sign-in tools, and 3 opt-in write tools gated behind a setting.\n\nRequires a CodeAnt account. Sign up at https://codeant.ai. To authenticate, call the `codeant_login` tool \u2014 it returns a sign-in link (and opens it in your browser when it can), then saves the token once you finish.\n\nCollects usage telemetry via PostHog by default (events are tied to your CodeAnt token); turn on \"Disable telemetry\" in the extension settings to opt out.",
+  "long_description": "CodeAnt AI inside Claude. Ask things like \"show my highest-priority Hotlist findings\", \"list AWS cloud findings\", \"show this pentest report\", or \"review my staged changes\" \u2014 Claude calls the CodeAnt API directly via this MCP server.\n\nIncludes 23 read-only tools, covering repository, Hotlist, cloud security, anti-pattern, and pentest findings plus an authenticated GET escape hatch for new APIs, 2 sign-in tools, and 3 opt-in write tools gated behind a setting.\n\nRequires a CodeAnt account. Sign up at https://codeant.ai. To authenticate, call the `codeant_login` tool \u2014 it returns a sign-in link (and opens it in your browser when it can), then saves the token once you finish.\n\nCollects usage telemetry via PostHog by default (events are tied to your CodeAnt token); turn on \"Disable telemetry\" in the extension settings to opt out.",
   "author": {
     "name": "CodeAnt AI",
     "email": "support@codeant.ai",

package.json

@@ -14,6 +14,7 @@
     "start": "node src/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:integration": "CODEANT_LIVE_TESTS=1 vitest run tests/scans tests/settings --no-file-parallelism --maxWorkers=1 --minWorkers=1",
     "mcpb:build": "node scripts/build-mcpb.mjs"
   },
   "keywords": [

scans.md

@@ -295,6 +295,8 @@ codeant findings repo --repo acme/backend --types secrets \
 codeant scans results --repo acme/backend --types secrets --secrets-scope all
 ```
 
+Latest history results retain the last completed assessment while a newer run is pending or failed; the run status still describes the latest job. An explicit `--history-run` retrieves only that run.
+
 `--secrets-scope` accepts `current` (default), `history`, or `all`. `--history-run` selects one immutable run identity; otherwise the latest history run is read. Status values are `not_started`, `queued`, `running`, `awaiting_verification`, `completed`, `failed`, and `disabled`. Failed and disabled runs are terminal outcomes, not clean scans. Jobs stalled for over one hour are reported as failed. When available, `last_completed_run_id` identifies the previous successful run. Results from incomplete runs must not be treated as a complete assessment.
 
 History findings expose `metadata.commit`, `branches`, `tags`, `scanned_at`, `only_in_history`, and native `verification_status`. Branches/tags contain the commit at scan time; they do not identify where it originated. `only_in_history` compares the secret identity against the selected, unfiltered snapshot, including findings dismissed or marked false positive. It is `null` when the baseline is unavailable. History-only retrieval works without a snapshot scan; in that case `scan` is `null`.
@@ -333,7 +335,7 @@ A vulnerable package can now include:
 }
 ```
 
-Use the direct introducer and manifest to select the dependency to edit. `fix_version` fixes the vulnerable package; it does not promise a safe version of its direct introducer. There can be multiple introducers and manifest locations. Lockfiles are null when unknown or generated rather than committed. Path status distinguishes `pending`, `resolved`, `partial`, and `unavailable`; a resolved empty list differs from unavailable evidence. Existing scans are readable, but missing evidence requires a new scan.
+Use the direct introducer and manifest to select the dependency to edit. `fix_version` fixes the vulnerable package; it does not promise a safe version of its direct introducer. There can be multiple introducers and manifest locations. Very large path payloads are bounded; `dependency_paths_truncated: true` and a `partial` path status identify incomplete public evidence. Lockfiles are null when unknown or generated rather than committed. Path status distinguishes `pending`, `resolved`, `partial`, and `unavailable`; a resolved empty list differs from unavailable evidence. Existing scans are readable, but missing evidence requires a new scan.
 
 Schema 1.1 adds `category_status` (including independent SCA `dependency_paths_status`), optional `history_run`, and category metadata. SCA IDs now include package/version/manifest context; history IDs include commit and secret identity. Existing current-secret IDs are unchanged. JSON and field projection preserve metadata; SARIF includes it in result properties, and CSV adds JSON-encoded `package` and `metadata` columns.
 
@@ -350,3 +352,5 @@ npm test -- tests/scans/history-secrets.test.js
 ```
 
 This suite reads the specified fixture; it does not trigger scans or modify settings.
+
+Scan-start aliases `anti_patterns` and `complex_functions` select the `antipatterns` scanner, which produces both result categories.

src/commands/scans/lib/normalize.js

@@ -94,7 +94,7 @@ export function normalizeIssue(issue, category) {
     metadata.fix_version = issue.fix_version || issue.fix_details?.fixed_version || issue.fixed_version || issue.first_patched_version || null;
     metadata.fix_available = issue.fix_available ?? issue.fix_details?.fix_available ?? !!metadata.fix_version;
     if (issue.fix_details?.vulnerable_version_range !== undefined) metadata.vulnerable_version_range = issue.fix_details.vulnerable_version_range;
-    for (const key of ['dependency_paths', 'dependency_paths_status', 'package_location', 'vulnerable_version_range', 'vulnerable_range', 'dependency_relationship']) {
+    for (const key of ['dependency_paths', 'dependency_paths_status', 'dependency_paths_truncated', 'package_location', 'vulnerable_version_range', 'vulnerable_range', 'dependency_relationship']) {
       if (issue[key] !== undefined) metadata[key] = issue[key];
     }
   } else if (category === 'duplicate_code') {

src/commands/scans/start-scan.js

@@ -55,7 +55,8 @@ async function resolveRemoteCommit(branch) {
 }
 
 export async function runStartScan({ repo, branch, commit, include, exclude, types, json = false, returnResult = false } = {}) {
-  const scanTypes = types ? types.split(',').map((value) => value.trim()).filter(Boolean) : undefined;
+  const aliases = { anti_patterns: 'antipatterns', complex_functions: 'antipatterns' };
+  const scanTypes = types ? [...new Set(types.split(',').map((value) => value.trim()).filter(Boolean).map((value) => aliases[value] || value))] : undefined;
   if (types !== undefined && (!scanTypes?.length || scanTypes.some((value) => !SCAN_TYPES.has(value)))) throw new Error('Invalid --types for scan start');
   const resolvedRepo = repo || detectRepoName();
   if (!resolvedRepo) {

src/scans/fetchAdvancedScanResults.js

@@ -291,6 +291,7 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType, opts
   try {
     if (resultType === ADVANCED_RESULT_TYPES.SECRETS && opts.secretsScope && opts.secretsScope !== 'current') {
       const history = await getHistoryResults(repo, commitId, opts);
+      const historyRun = { ...history.run, results_run_id: history.results_run_id, results_status: history.results_status };
       const occurrences = new Map();
       const historyIssues = (history.findings || []).map((item) => {
         const issue = normalizeAdvancedIssue({ ...item, finding_scope: 'history' }, resultType);
@@ -300,20 +301,25 @@ export async function fetchAdvancedScanResults(repo, commitId, resultType, opts
         return { ...issue, occurrence_index: occurrenceIndex };
       });
       if (opts.secretsScope === 'history') {
-        return { success: true, issues: historyIssues, status: history.status, historyRun: history.run };
+        return { success: true, issues: historyIssues, status: history.status, historyRun };
       }
       const current = await fetchAdvancedScanResults(repo, commitId, resultType, { ...opts, secretsScope: 'current' });
       if (!current.success) return current;
       const identity = (issue) => JSON.stringify([issue.file_path, issue.hashed_secret, issue.type || issue.secret_type]);
-      const byIdentity = new Map(current.issues.filter((issue) => issue.hashed_secret).map((issue) => [identity(issue), issue]));
+      const byIdentity = new Map();
+      for (const issue of current.issues.filter((issue) => issue.hashed_secret)) {
+        const key = identity(issue);
+        if (!byIdentity.has(key)) byIdentity.set(key, []);
+        byIdentity.get(key).push(issue);
+      }
       const remaining = [];
       for (const issue of historyIssues) {
-        const match = byIdentity.get(identity(issue));
-        if (match) {
-          (match.history_occurrences ??= []).push({ commit: issue.commit, file_path: issue.file_path, line_number: issue.line_number, branches: issue.branches, tags: issue.tags, verification_status: issue.verification_status, scanned_at: issue.scanned_at });
+        const matches = byIdentity.get(identity(issue));
+        if (matches) {
+          for (const match of matches) (match.history_occurrences ??= []).push({ commit: issue.commit, file_path: issue.file_path, line_number: issue.line_number, branches: issue.branches, tags: issue.tags, verification_status: issue.verification_status, scanned_at: issue.scanned_at });
         } else remaining.push(issue);
       }
-      return { ...current, issues: [...current.issues, ...remaining], historyRun: history.run };
+      return { ...current, issues: [...current.issues, ...remaining], historyRun };
     }
     const response = await fetchApi('/extension/scans2/fetch-advanced-results', 'POST', {
       repo,

tests/historyResultsContract.test.js

@@ -36,6 +36,13 @@ describe('history results contract', () => {
     expect(JSON.stringify(envelope)).not.toContain('hashed_secret');
   });
 
+  it('identifies the completed result behind a newer failed history run', async () => {
+    mocks.fetchApiResponse.mockResolvedValue({ ok: true, status: 200, data: { findings: [occurrence], status: 'failed', run: { scan_run_id: run, status: 'failed' }, results_run_id: 'previous-completed-run', results_status: 'completed' } });
+    const envelope = await runResults({ repo, types: 'secrets', secretsScope: 'history', returnEnvelope: true });
+    expect(envelope.findings).toHaveLength(1);
+    expect(envelope.history_run).toMatchObject({ status: 'failed', results_run_id: 'previous-completed-run', results_status: 'completed' });
+  });
+
   it('works without a snapshot and keeps run metadata separate', async () => {
     mocks.resolveScan.mockRejectedValue(Object.assign(new Error('no scans found'), { exitCode: 2 }));
     const envelope = await runResults({ repo, types: 'secrets', secretsScope: 'history', returnEnvelope: true });
@@ -59,6 +66,20 @@ describe('history results contract', () => {
     expect(first.id).not.toBe(second.id);
   });
 
+  it('attaches history evidence to every matching current occurrence', async () => {
+    mocks.fetchApi.mockResolvedValue({ secrets: { 'old.env': [8, 12].map((line_number) => ({ type: 'example', hashed_secret: 'hash', line_number })) }, status: 'done' });
+    const result = await fetchSecretsResults(repo, commit, { secretsScope: 'all' });
+    expect(result.issues).toHaveLength(2);
+    for (const issue of result.issues) expect(issue.history_occurrences).toHaveLength(1);
+    expect(result.issues[0].history_occurrences).toEqual(result.issues[1].history_occurrences);
+  });
+
+  it('maps public scanner aliases to the scanner that produces both results', async () => {
+    mocks.fetchApi.mockResolvedValue({ scan_run_id: run });
+    await runStartScan({ repo, branch: 'main', commit, types: 'anti_patterns,complex_functions,antipatterns', returnResult: true });
+    expect(mocks.fetchApi).toHaveBeenCalledWith('/extension/analysis/run', 'POST', expect.objectContaining({ scan_types: ['antipatterns'] }));
+  });
+
   it('projects metadata without dropping the run state', async () => {
     const envelope = await runResults({ repo, types: 'secrets', secretsScope: 'history', fields: 'id,metadata', returnEnvelope: true });
     expect(Object.keys(envelope.findings[0])).toEqual(['id', 'metadata']);
@@ -116,10 +137,10 @@ describe('history results contract', () => {
 describe('SCA remediation contract', () => {
   it('retains manifest, paths and fixed versions through fetch and normalization', async () => {
     const dependencyPaths = [{ manifest: 'apps/web/package.json', lockfile: 'pnpm-lock.yaml', packages: ['direct@1', 'vulnerable@1'], direct_dependency: 'direct@1', resolution: 'COMMITTED_LOCK' }];
-    mocks.fetchApi.mockResolvedValue({ status: 'done', results: { dependency_paths_status: 'done', all_vulnerabilities: [{ package_name: 'vulnerable', package_version: '1', ecosystem: 'NPM', cve_id: 'CVE-EXAMPLE', relative_path: 'apps/web/package.json', dependency_paths: dependencyPaths, dependency_paths_status: 'resolved', fix_details: { fixed_version: '2', fix_available: true } }] } });
+    mocks.fetchApi.mockResolvedValue({ status: 'done', results: { dependency_paths_status: 'done', all_vulnerabilities: [{ package_name: 'vulnerable', package_version: '1', ecosystem: 'NPM', cve_id: 'CVE-EXAMPLE', relative_path: 'apps/web/package.json', dependency_paths: dependencyPaths, dependency_paths_truncated: true, dependency_paths_status: 'resolved', fix_details: { fixed_version: '2', fix_available: true } }] } });
     const result = await fetchScaResults(repo, commit);
     const finding = normalizeIssue(result.issues[0], 'sca');
-    expect(finding).toMatchObject({ file_path: 'apps/web/package.json', metadata: { dependency_paths: dependencyPaths, fix_version: '2', fix_available: true } });
+    expect(finding).toMatchObject({ file_path: 'apps/web/package.json', metadata: { dependency_paths: dependencyPaths, dependency_paths_truncated: true, fix_version: '2', fix_available: true } });
     expect(result.dependencyPathsStatus).toBe('done');
     expect(finding.id).not.toBe(normalizeIssue({ ...result.issues[0], package_version: '3' }, 'sca').id);
   });