feat(report): suppress findings from a baseline run

[ousamabenyounes]

Summary

• Add --baseline-run RUN_NAME for fresh scans, validated against ./strix_runs/<run>/vulnerabilities.json before Docker/LLM startup.
• Load the baseline findings into ReportState as a separate non-persisted dedupe corpus for both CLI and TUI runs.
• Persist baseline_run in run.json so resumed runs keep the same known-findings baseline, and document the new CLI option.

Fixes #900

Test verification (RED → GREEN)

RED, test-only on upstream main:

$ uv run pytest tests/test_cli_target_list.py::test_parse_arguments_accepts_baseline_run tests/test_reporting_fields.py::test_create_report_dedupes_against_baseline_run -q
FF [100%]
SystemExit: 2
strix: error: unrecognized arguments: --baseline-run baseline-alpha
AttributeError: 'ReportState' object has no attribute 'load_baseline_vulnerabilities'
2 failed in 6.58s

GREEN, after fix:

$ uv run pytest tests/test_cli_target_list.py::test_parse_arguments_accepts_baseline_run tests/test_reporting_fields.py::test_create_report_suppresses_duplicate_from_baseline_run -q
.. [100%]
2 passed in 4.62s

Focused regression suite:

$ uv run pytest tests/test_cli_target_list.py tests/test_reporting_fields.py tests/test_report_writer.py -q
35 passed in 6.67s

Full suite:

$ uv run pytest -q
593 passed, 2 warnings in 40.78s

Additional checks:

$ uv run ruff check strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py strix/interface/tui/app.py tests/test_cli_target_list.py tests/test_reporting_fields.py
All checks passed!

$ uv run ruff format --check strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py strix/interface/tui/app.py tests/test_cli_target_list.py tests/test_reporting_fields.py
7 files already formatted

$ uv run mypy strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py
Success: no issues found in 4 source files

$ uv run bandit -q -c pyproject.toml strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py
exit 0

Known validation baseline:

$ uv run mypy strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py strix/interface/tui/app.py
58 pre-existing Textual typing errors in strix/interface/tui/app.py

$ uv run pyright strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py tests/test_cli_target_list.py tests/test_reporting_fields.py
89 pre-existing unknown/private-usage/import-cycle errors across existing files/tests

[greptile-apps]

Greptile Summary

Adds cross-run finding suppression using a prior run’s vulnerability report.

• Introduces and documents the --baseline-run CLI option with early baseline validation.
• Persists the selected baseline in run.json and restores it when resuming a scan.
• Loads baseline findings into report state for duplicate detection without writing them into current-run artifacts.
• Adds argument-parsing and baseline-deduplication tests.

Confidence Score: 3/5

The PR should not merge until baseline findings are restricted to deduplication and excluded from active-run listing, counts, and lookup.

The combined getter is correctly useful for duplicate checks, but existing report-management callers also consume it, causing prior-run findings to be presented as current scan results.

Files Needing Attention: strix/report/state.py

Important Files Changed

Filename	Overview
strix/interface/main.py	Adds baseline argument parsing, validation, persistence, and resume restoration.
strix/interface/cli.py	Threads the baseline selection into non-interactive report-state initialization.
strix/interface/tui/app.py	Threads the baseline selection into TUI report-state initialization.
strix/report/state.py	Loads a separate baseline corpus but unintentionally exposes it through general report listing and lookup.
strix/report/writer.py	Centralizes vulnerability-file parsing and the artifact filename constant.
tests/test_reporting_fields.py	Verifies duplicate suppression but does not cover isolation of baseline findings from current-run listing and lookup.
tests/test_cli_target_list.py	Covers acceptance of a valid baseline-run argument.
docs/usage/cli.mdx	Documents baseline-run usage and duplicate-suppression behavior.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
strix/report/state.py:324
**Baseline findings pollute active reports**

When a baseline is configured, this getter returns baseline and current-run findings together; `list_reports` consequently includes prior-run findings in active totals and severity counts, while `get_report` can return a prior-run finding as though it belonged to the current scan.

_{Reviews (1): Last reviewed commit: "feat(report): suppress baseline run dupl..." | Re-trigger Greptile}

[ousamabenyounes]

Fixed in 4f28417.

Baseline findings now stay out of active report listing/lookup:

• get_existing_vulnerabilities() returns only current-run findings again.
• New get_dedupe_vulnerabilities() combines baseline + current reports only for create-report dedupe checks.
• Added regression coverage that list_reports totals/severity counts and get_report exclude baseline findings while duplicate suppression still uses them.

Validation:

$ uv run pytest tests/test_reporting_fields.py::test_create_report_suppresses_duplicate_from_baseline_run tests/test_list_reports.py::test_list_reports_and_get_report_exclude_baseline_findings -q
2 passed in 1.97s

$ uv run pytest tests/test_reporting_fields.py tests/test_list_reports.py tests/test_cli_target_list.py tests/test_report_writer.py -q
64 passed in 26.72s

$ uv run ruff check strix/report/state.py strix/tools/reporting/tool.py tests/test_reporting_fields.py tests/test_list_reports.py
All checks passed!

$ uv run ruff format --check strix/report/state.py strix/tools/reporting/tool.py tests/test_reporting_fields.py tests/test_list_reports.py
4 files already formatted

$ uv run mypy strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py strix/tools/reporting/tool.py
Success: no issues found in 5 source files

$ uv run bandit -q -c pyproject.toml strix/report/writer.py strix/report/state.py strix/interface/main.py strix/interface/cli.py strix/tools/reporting/tool.py
exit 0