feat(vulns): add close and reopen commands and --status filter

.claude/skills/detail-bugs/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: detail-bugs
-description: Interact with Detail bugs for a repository via the CLI — list and filter bugs, inspect reports, close as resolved or dismissed, reopen previously closed bugs, and override a bug's priority. Also covers read-only access to security scan findings (`detail vulns`).
+description: Interact with Detail bugs for a repository via the CLI — list and filter bugs, inspect reports, close as resolved or dismissed, reopen previously closed bugs, and override a bug's priority. Also covers security scan findings (`detail vulns`): list, show, close, and reopen.
 ---
 
 # Detail Bugs
 
-The Detail CLI exposes per-repository bugs through five subcommands: `list`, `show`, `close`, `reopen`, and `prioritize`. Findings from Detail's security scans live separately under `detail vulns` (read-only). This skill describes both surfaces so you can pick the right command for whatever the user is trying to do.
+The Detail CLI exposes per-repository bugs through five subcommands: `list`, `show`, `close`, `reopen`, and `prioritize`. Findings from Detail's security scans live separately under `detail vulns`. This skill describes both surfaces so you can pick the right command for whatever the user is trying to do.
 
 ## Prerequisites
 
@@ -70,21 +70,35 @@ Setting the priority a bug already has is a no-op — the CLI reports "no change
 
 ## Security scan findings (`detail vulns`)
 
-Security scans produce findings ("vulns") that are separate from bugs: they have a severity (`critical`, `high`, `medium`, `low`) instead of a priority, and no review state — there is no close, reopen, or prioritize for them. Vuln IDs look like `ssf_…`. When the user asks about security scan results or vulnerabilities from a security scan, use these commands rather than `detail bugs list --vulns`.
+Security scans produce findings ("vulns") that are separate from bugs: they have a severity (`critical`, `high`, `medium`, `low`) instead of a priority, so there is no prioritize for them. They can be closed and reopened like bugs. A finding's state can also change without a review: a merged Detail fix PR or a closed tracker issue sets it, and the latest event wins. Vuln IDs look like `ssf_…`. When the user asks about security scan results or vulnerabilities from a security scan, use these commands rather than `detail bugs list --vulns`.
 
 ### `detail vulns list [REPO]`
 
+- `--status pending|resolved|dismissed` — one value; default `pending`, so closed findings are hidden unless asked for. To see every state, run it once per state.
 - `--severity critical|high|medium|low` — comma-separate or repeat the flag (e.g. `--severity critical,high`). Default: every severity.
 - `--sort newest|oldest|severity` — default `newest`. `severity` puts the most severe first.
 - `--scan-id <wr_…>` — limit to a specific security scan. Workflow IDs come from `detail vulns scans`.
 - `--since` / `--until`, `--all`, `--limit <1-100>` (default 50), `--page <N>`, `--format table|json` — same as `detail bugs list`.
 
 ### `detail vulns show <VULN_ID>`
 
-Shows the full finding: severity, file, commit, scan, linked issues, the fix PR if any, and a markdown description of the flaw, how it is reached, and the fix.
+Shows the full finding: severity, state (with dismissal reason, notes, and what set it, when present), file, commit, scan, linked issues, the fix PR if any, and a markdown description of the flaw, how it is reached, and the fix.
 
 - `--format table|json`.
 
+### `detail vulns close <VULN_ID>`
+
+Marks a finding as resolved or dismissed. The CLI prompts for `--state` interactively in a TTY; pass it explicitly when invoking non-interactively.
+
+- `--state resolved|dismissed`.
+- `--dismissal-reason not-exploitable|wont-fix|duplicate|other` — required when state is `dismissed`.
+- `--notes "..."` — optional free-form context, up to 2000 characters.
+- `--format table|json`.
+
+### `detail vulns reopen <VULN_ID>`
+
+Flips a previously resolved or dismissed finding back to `pending`. Takes only the vuln ID. The earlier reason and notes do not carry over.
+
 ### `detail vulns scans [REPO]`
 
 Lists recent security scans with per-severity finding counts.

docs/HELP.md

@@ -37,6 +37,8 @@ This document contains the help content for the `detail` command-line program.
 * [`detail vulns`↴](#detail-vulns)
 * [`detail vulns list`↴](#detail-vulns-list)
 * [`detail vulns show`↴](#detail-vulns-show)
+* [`detail vulns close`↴](#detail-vulns-close)
+* [`detail vulns reopen`↴](#detail-vulns-reopen)
 * [`detail vulns scans`↴](#detail-vulns-scans)
 
 ## `detail`
@@ -63,7 +65,7 @@ Common workflow:
 * `skill` — Install Detail skills (default: detail-bugs, which also covers vulns)
 * `update` — Update immediately (auto-update also runs in the background)
 * `version` — Show version information
-* `vulns` — List and inspect findings from security scans
+* `vulns` — List, show, and close findings from security scans
 
 
 
@@ -568,14 +570,16 @@ Show version information
 
 ## `detail vulns`
 
-List and inspect findings from security scans
+List, show, and close findings from security scans
 
 **Usage:** `detail vulns <COMMAND>`
 
 ###### **Subcommands:**
 
 * `list` — List security scan findings for a given repository
 * `show` — Show the report for a security scan finding
+* `close` — Close a security scan finding as resolved or dismissed
+* `reopen` — Reopen a previously resolved or dismissed finding — flips it back to pending. Useful when a fix is reverted or a dismissal is overturned
 * `scans` — List recent security scans for a repository
 
 
@@ -592,6 +596,10 @@ List security scan findings for a given repository
 
 ###### **Options:**
 
+* `--status <STATUS>` — Only show findings in this state. Takes one value. Default: pending (applied by the API), so closed findings stay hidden unless asked for
+
+  Possible values: `pending`, `resolved`, `dismissed`
+
 * `--severity <SEVERITY>` — Only show findings at these severities — repeat the flag or comma-separate values (e.g. `--severity critical,high`). Default: all severities
 
   Possible values: `critical`, `high`, `medium`, `low`
@@ -642,6 +650,48 @@ Show the report for a security scan finding
 
 
 
+## `detail vulns close`
+
+Close a security scan finding as resolved or dismissed
+
+**Usage:** `detail vulns close [OPTIONS] <VULN_ID>`
+
+###### **Arguments:**
+
+* `<VULN_ID>` — Vuln ID
+
+###### **Options:**
+
+* `--state <STATE>` — Close state (prompted interactively if omitted in a TTY)
+
+  Possible values: `resolved`, `dismissed`
+
+* `--dismissal-reason <DISMISSAL_REASON>` — Dismissal reason (required if state is dismissed)
+
+  Possible values: `not-exploitable`, `wont-fix`, `duplicate`, `other`
+
+* `--notes <NOTES>` — Additional notes (up to 2000 characters)
+* `--format <FORMAT>` — Output format
+
+  Default value: `table`
+
+  Possible values: `table`, `json`
+
+
+
+
+## `detail vulns reopen`
+
+Reopen a previously resolved or dismissed finding — flips it back to pending. Useful when a fix is reverted or a dismissal is overturned
+
+**Usage:** `detail vulns reopen <VULN_ID>`
+
+###### **Arguments:**
+
+* `<VULN_ID>` — Vuln ID
+
+
+
 ## `detail vulns scans`
 
 List recent security scans for a repository