feat(vulns): add read-only detail vulns command for security scan findings

.claude/skills/detail-bugs/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: detail-bugs
-description: Interact with Detail bugs for a repository via the CLI — list and filter bugs, inspect reports, close as resolved or dismissed, reopen previously closed bugs, and override a bug's priority.
+description: Interact with Detail bugs for a repository via the CLI — list and filter bugs, inspect reports, close as resolved or dismissed, reopen previously closed bugs, and override a bug's priority. Also covers read-only access to security scan findings (`detail vulns`).
 ---
 
 # Detail Bugs
 
-The Detail CLI exposes per-repository bugs through five subcommands: `list`, `show`, `close`, `reopen`, and `prioritize`. This skill describes that surface so you can pick the right command for whatever the user is trying to do.
+The Detail CLI exposes per-repository bugs through five subcommands: `list`, `show`, `close`, `reopen`, and `prioritize`. Findings from Detail's security scans live separately under `detail vulns` (read-only). This skill describes both surfaces so you can pick the right command for whatever the user is trying to do.
 
 ## Prerequisites
 
@@ -27,7 +27,7 @@ The Detail CLI infers the repository from the git or jj remote; if the user spec
 Lists bugs for the inferred or specified repository.
 
 - `--status pending|resolved|dismissed` — default `pending`; comma-separate or repeat the flag to combine (e.g. `--status resolved,dismissed`).
-- `--vulns` — only security vulnerabilities.
+- `--vulns` — only bugs the bug finder flagged as security vulnerabilities. For findings from security scans, use `detail vulns list` instead.
 - `--priority p1|p2|p3|none` — only bugs at these priorities; comma-separate or repeat the flag (e.g. `--priority p1,p2`). `none` selects bugs Detail never scored — most bugs found before priority scoring shipped, so prefer `--priority p1,p2,p3` over `--priority p1` when the user asks for "prioritized" bugs. Default: every priority.
 - `--sort newest|oldest|priority` — default `newest`. `priority` puts the most severe first and unscored last.
 - `--introduced-by <authors>` — filter by authors (comma-separated or repeated).
@@ -67,3 +67,26 @@ Overrides Detail's priority for a bug and records the change on its timeline. Th
 - `--format table|json`.
 
 Setting the priority a bug already has is a no-op — the CLI reports "no change" rather than recording a second identical entry.
+
+## Security scan findings (`detail vulns`)
+
+Security scans produce findings ("vulns") that are separate from bugs: they have a severity (`critical`, `high`, `medium`, `low`) instead of a priority, and no review state — there is no close, reopen, or prioritize for them. Vuln IDs look like `ssf_…`. When the user asks about security scan results or vulnerabilities from a security scan, use these commands rather than `detail bugs list --vulns`.
+
+### `detail vulns list [REPO]`
+
+- `--severity critical|high|medium|low` — comma-separate or repeat the flag (e.g. `--severity critical,high`). Default: every severity.
+- `--sort newest|oldest|severity` — default `newest`. `severity` puts the most severe first.
+- `--scan-id <wr_…>` — limit to a specific security scan. Workflow IDs come from `detail vulns scans`.
+- `--since` / `--until`, `--all`, `--limit <1-100>` (default 50), `--page <N>`, `--format table|json` — same as `detail bugs list`.
+
+### `detail vulns show <VULN_ID>`
+
+Shows the full finding: severity, file, commit, scan, linked issues, the fix PR if any, and a markdown description of the flaw, how it is reached, and the fix.
+
+- `--format table|json`.
+
+### `detail vulns scans [REPO]`
+
+Lists recent security scans with per-severity finding counts.
+
+- `--status in-progress|complete|failed|dlq`, `--since` / `--until`, `--limit`, `--page`, `--format table|json`.

docs/HELP.md

@@ -34,6 +34,10 @@ This document contains the help content for the `detail` command-line program.
 * [`detail skill rules`↴](#detail-skill-rules)
 * [`detail update`↴](#detail-update)
 * [`detail version`↴](#detail-version)
+* [`detail vulns`↴](#detail-vulns)
+* [`detail vulns list`↴](#detail-vulns-list)
+* [`detail vulns show`↴](#detail-vulns-show)
+* [`detail vulns scans`↴](#detail-vulns-scans)
 
 ## `detail`
 
@@ -56,9 +60,10 @@ Common workflow:
 * `satisfying-sort` — Run a fun animation. Humans only
 * `repos` — Manage repos tracked with Detail
 * `scans` — List and inspect scans
-* `skill` — Install Detail skills (default: detail-bugs)
+* `skill` — Install Detail skills (default: detail-bugs, which also covers vulns)
 * `update` — Update immediately (auto-update also runs in the background)
 * `version` — Show version information
+* `vulns` — List and inspect findings from security scans
 
 
 
@@ -138,7 +143,7 @@ List bugs for a given repository
 
   Possible values: `pending`, `resolved`, `dismissed`
 
-* `--vulns` — Only show security vulnerabilities
+* `--vulns` — Only show bugs that Detail's bug finder flagged as security vulnerabilities. For findings from security scans, use `detail vulns list`
 * `--priority <PRIORITY>` — Only show bugs at these priorities — repeat the flag or comma-separate values (e.g. `--priority p1,p2`). Use `none` for bugs Detail never assigned a priority. Default: all priorities
 
   Possible values: `p1`, `p2`, `p3`, `none`
@@ -523,7 +528,7 @@ List recent scans for a repository
 
 ## `detail skill`
 
-Install Detail skills (default: detail-bugs)
+Install Detail skills (default: detail-bugs, which also covers vulns)
 
 **Usage:** `detail skill [OPTIONS] [COMMAND]`
 
@@ -561,6 +566,115 @@ Show version information
 
 
 
+## `detail vulns`
+
+List and inspect findings from security scans
+
+**Usage:** `detail vulns <COMMAND>`
+
+###### **Subcommands:**
+
+* `list` — List security scan findings for a given repository
+* `show` — Show the report for a security scan finding
+* `scans` — List recent security scans for a repository
+
+
+
+## `detail vulns list`
+
+List security scan findings for a given repository
+
+**Usage:** `detail vulns list [OPTIONS] [REPO]`
+
+###### **Arguments:**
+
+* `<REPO>` — Repository by owner/repo (e.g., usedetail/cli) or repo (e.g., cli). If omitted, inferred from the git or jj remote (origin)
+
+###### **Options:**
+
+* `--severity <SEVERITY>` — Only show findings at these severities — repeat the flag or comma-separate values (e.g. `--severity critical,high`). Default: all severities
+
+  Possible values: `critical`, `high`, `medium`, `low`
+
+* `--sort <SORT>` — Result ordering. `severity` puts the most severe findings first
+
+  Default value: `newest`
+
+  Possible values: `newest`, `oldest`, `severity`
+
+* `--scan-id <SCAN_ID>` — Filter findings to a specific security scan by workflow request ID
+* `--since <SINCE>` — Only show findings created at or after this point. Accepts a duration (e.g. 1d, 24h, 30m) interpreted as "now minus this", an ISO date (YYYY-MM-DD), or an RFC3339 timestamp
+* `--until <UNTIL>` — Only show findings created at or before this point. Same forms as --since
+* `--all` — Auto-paginate: fetch every matching finding instead of a single page
+* `--limit <LIMIT>` — Maximum number of results per page
+
+  Default value: `50`
+* `--page <PAGE>` — Page number (starts at 1)
+
+  Default value: `1`
+* `--format <FORMAT>` — Output format
+
+  Default value: `table`
+
+  Possible values: `table`, `json`
+
+
+
+
+## `detail vulns show`
+
+Show the report for a security scan finding
+
+**Usage:** `detail vulns show [OPTIONS] <VULN_ID>`
+
+###### **Arguments:**
+
+* `<VULN_ID>` — Vuln ID
+
+###### **Options:**
+
+* `--format <FORMAT>` — Output format
+
+  Default value: `table`
+
+  Possible values: `table`, `json`
+
+
+
+
+## `detail vulns scans`
+
+List recent security scans for a repository
+
+**Usage:** `detail vulns scans [OPTIONS] [REPO]`
+
+###### **Arguments:**
+
+* `<REPO>` — Repository in owner/repo format or just repo name. If omitted, inferred from the git or jj remote (origin)
+
+###### **Options:**
+
+* `--status <STATUS>` — Filter by workflow status (e.g. failed scans in the last day)
+
+  Possible values: `in-progress`, `complete`, `failed`, `dlq`
+
+* `--since <SINCE>` — Only show scans created at or after this point. Accepts a duration (e.g. 1d, 24h, 30m), an ISO date (YYYY-MM-DD), or an RFC3339 timestamp
+* `--until <UNTIL>` — Only show scans created at or before this point. Same forms as --since
+* `--limit <LIMIT>` — Maximum number of results per page
+
+  Default value: `50`
+* `--page <PAGE>` — Page number (starts at 1)
+
+  Default value: `1`
+* `--format <FORMAT>` — Output format
+
+  Default value: `table`
+
+  Possible values: `table`, `json`
+
+
+
+
 <hr/>
 
 <small><i>