From 17dc6130b186c4f6eaeab47fda6dfa922649073a Mon Sep 17 00:00:00 2001
From: Ousama Ben Younes <benyounes.ousama@gmail.com>
Date: Mon, 27 Jul 2026 18:16:10 +0000
Subject: [PATCH] fix(report): keep baseline findings out of active listings

---
 strix/report/state.py         |  3 +++
 strix/tools/reporting/tool.py |  4 ++--
 tests/test_list_reports.py    | 43 +++++++++++++++++++++++++++++++++++
 3 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/strix/report/state.py b/strix/report/state.py
index d3b96b70..5530a73d 100644
--- a/strix/report/state.py
+++ b/strix/report/state.py
@@ -528,6 +528,9 @@ class ReportState:
         return report
 
     def get_existing_vulnerabilities(self) -> list[dict[str, Any]]:
+        return list(self.vulnerability_reports)
+
+    def get_dedupe_vulnerabilities(self) -> list[dict[str, Any]]:
         return [*self.baseline_vulnerability_reports, *self.vulnerability_reports]
 
     def record_sdk_usage(
diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py
index 58c21a8e..a6116f06 100644
--- a/strix/tools/reporting/tool.py
+++ b/strix/tools/reporting/tool.py
@@ -674,7 +674,7 @@ async def _do_create(
 
         from strix.report.dedupe import check_duplicate
 
-        existing = report_state.get_existing_vulnerabilities()
+        existing = report_state.get_dedupe_vulnerabilities()
         candidate = {
             "title": title,
             "description": description,
@@ -1705,7 +1705,7 @@ async def _do_create_dependency(  # noqa: PLR0912
 
         from strix.report.dedupe import check_duplicate
 
-        existing = report_state.get_existing_vulnerabilities()
+        existing = report_state.get_dedupe_vulnerabilities()
         candidate = {
             "title": title,
             "description": description,
diff --git a/tests/test_list_reports.py b/tests/test_list_reports.py
index 2542da22..b0f1519d 100644
--- a/tests/test_list_reports.py
+++ b/tests/test_list_reports.py
@@ -20,6 +20,15 @@ if TYPE_CHECKING:
     from pathlib import Path
 
 
+BASELINE_RUN_NAME = "baseline-run"
+BASELINE_REPORT_ID = "vuln-0042"
+BASELINE_REPORT_TITLE = "Baseline SQL injection"
+BASELINE_REPORT_SEVERITY = "critical"
+BASELINE_REPORT_TIMESTAMP = "2026-07-27 00:00:00 UTC"
+BASELINE_REPORT_TARGET = "https://baseline.example.com"
+CURRENT_REPORT_TITLE = "Reflected XSS in search"
+
+
 @pytest.fixture
 def report_state(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> ReportState:
     monkeypatch.chdir(tmp_path)
@@ -174,6 +183,40 @@ def test_list_reports_metadata_first_and_sorted(report_state: ReportState) -> No
     assert "evidence" not in first
 
 
+def test_list_reports_and_get_report_exclude_baseline_findings(
+    report_state: ReportState,
+) -> None:
+    baseline_report = {
+        "id": BASELINE_REPORT_ID,
+        "title": BASELINE_REPORT_TITLE,
+        "severity": BASELINE_REPORT_SEVERITY,
+        "timestamp": BASELINE_REPORT_TIMESTAMP,
+        "target": BASELINE_REPORT_TARGET,
+    }
+    report_state.load_baseline_vulnerabilities(BASELINE_RUN_NAME, [baseline_report])
+    report_state.add_vulnerability_report(
+        title=CURRENT_REPORT_TITLE,
+        severity="medium",
+        description="q reflects unencoded input.",
+        target="https://app.example.com",
+    )
+
+    listed = _do_list_reports(
+        severity=None,
+        finding_class=None,
+        target=None,
+        search=None,
+        include_details=False,
+    )
+    baseline_lookup = _do_get_report(BASELINE_REPORT_ID)
+
+    assert listed["total_count"] == 1
+    assert listed["severity_counts"] == {"medium": 1}
+    assert [report["title"] for report in listed["reports"]] == [CURRENT_REPORT_TITLE]
+    assert baseline_lookup["success"] is False
+    assert baseline_lookup["report"] is None
+
+
 def test_list_reports_filter_severity(report_state: ReportState) -> None:
     _seed(report_state)
     result = _do_list_reports(