Group findings by file, line proximity, and normalized title keywords,
keeping the highest-severity finding from each group and merging CWE info.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@@ -71,3 +72,4 @@
+            findings: deduped,
             sbom_entries: Vec::new(),
         }
     }

@@ -71,3 +72,4 @@
+            findings: deduped,
             sbom_entries: Vec::new(),
         }
     }

@@ -97,3 +97,2 @@
 
-    // Fetch DAST findings for this session
-    let findings: Vec<DastFinding> = match agent
+    // Fetch DAST findings for this session, then deduplicate

@@ -109,0 +109,4 @@
+    let raw_count = raw_findings.len();
+    let findings = crate::pipeline::dedup::dedup_dast_findings(raw_findings);
+    if findings.len() < raw_count {
+        tracing::info!(

@@ -327,0 +337,4 @@
+                                        let existing = self
+                                            .db
+                                            .dast_findings()
+                                            .find_one(doc! {

@@ -327,0 +342,4 @@
+                                                "title": &finding.title,
+                                                "endpoint": &finding.endpoint,
+                                                "method": &finding.method,
+                                            })

@@ -327,0 +344,4 @@
+                                                "method": &finding.method,
+                                            })
+                                            .await;
+                                        if matches!(existing, Ok(Some(_))) {

@@ -184,3 +186,51 @@ struct ReviewIssue {
     #[serde(default)]
     suggestion: Option<String>,
 }
+

@@ -187,0 +191,4 @@
+///
+/// Multiple passes often flag the same issue (e.g. SQL injection reported by
+/// logic, security, and convention passes). We group by file + nearby line +
+/// normalized title keywords and keep the highest-severity finding.

@@ -187,0 +194,4 @@
+/// normalized title keywords and keep the highest-severity finding.
+fn dedup_cross_pass(findings: Vec<Finding>) -> Vec<Finding> {
+    use std::collections::HashMap;
+

@@ -187,0 +213,4 @@
+    let mut groups: HashMap<String, Finding> = HashMap::new();
+
+    for finding in findings {
+        let key = dedup_key(&finding);

@@ -9,9 +11,209 @@ pub fn compute_fingerprint(parts: &[&str]) -> String {
     hex::encode(hasher.finalize())
 }
 
+/// Compute a dedup fingerprint for a DAST finding.

@@ -12,0 +35,4 @@
+fn canonicalize_dast_title(title: &str) -> String {
+    let mut s = title.to_lowercase();
+
+    // Strip "for <domain>" or "on <domain>" suffixes

@@ -12,0 +51,4 @@
+        }
+    }
+
+    // Resolve known header synonyms

@@ -12,0 +52,4 @@
+    }
+
+    // Resolve known header synonyms
+    let synonyms: &[(&str, &str)] = &[

@@ -12,0 +55,4 @@
+    let synonyms: &[(&str, &str)] = &[
+        ("hsts", "strict-transport-security"),
+        ("csp", "content-security-policy"),
+        ("cors", "cross-origin-resource-sharing"),

@@ -12,0 +111,4 @@
+    // Group by (cwe, endpoint_normalized, method) — only when CWE is present
+    let mut cwe_groups: HashMap<String, Vec<usize>> = HashMap::new();
+    for (i, f) in deduped.iter().enumerate() {
+        if let Some(ref cwe) = f.cwe {

@@ -12,0 +117,4 @@
+                cwe,
+                f.endpoint.to_lowercase().trim_end_matches('/'),
+                f.method.to_uppercase(),
+            );

@@ -12,0 +137,4 @@
+                .severity
+                .cmp(&deduped[b].severity)
+                .then_with(|| deduped[a].evidence.len().cmp(&deduped[b].evidence.len()))
+                .then_with(|| {

@@ -58,0 +275,4 @@
+
+    #[test]
+    fn canonicalize_strips_domain_suffix() {
+        let canon = canonicalize_dast_title("Missing HSTS header for comp-dev.meghsakha.com");

@@ -58,0 +279,4 @@
+        assert!(!canon.contains("meghsakha"), "domain should be stripped");
+        assert!(
+            canon.contains("strict-transport-security"),
+            "hsts should be resolved: {canon}"

@@ -89,12 +90,37 @@ impl PipelineOrchestrator {
             return Ok(());
         }
 
+        // Dedup findings by fingerprint to avoid duplicate comments

@@ -92,0 +95,4 @@
+        let mut unique_findings: Vec<&Finding> = Vec::new();
+        for finding in &pr_findings {
+            let fp = compute_fingerprint(&[
+                repo_id,

@@ -92,0 +97,4 @@
+            let fp = compute_fingerprint(&[
+                repo_id,
+                &pr_number.to_string(),
+                finding.file_path.as_deref().unwrap_or(""),

@@ -92,0 +100,4 @@
+                finding.file_path.as_deref().unwrap_or(""),
+                &finding.line_number.unwrap_or(0).to_string(),
+                &finding.title,
+            ]);

@@ -92,0 +102,4 @@
+                &finding.title,
+            ]);
+            if seen_fps.insert(fp) {
+                unique_findings.push(finding);

@@ -92,0 +104,4 @@
+            if seen_fps.insert(fp) {
+                unique_findings.push(finding);
+            }
+        }

@@ -123,6 +149,17 @@ impl PipelineOrchestrator {
                 .join("\n"),

@@ -123,6 +149,17 @@ impl PipelineOrchestrator {
                 .join("\n"),
         );
 
+        if review_comments.is_empty() {