feat(cli): browse historical security findings - #275
Conversation
…gs-history-discovery
…gs-history-discovery
|
@codex review |
There was a problem hiding this comment.
Pull request overview
This PR adds first-class CLI support for browsing historical scan findings, including repository-scoped and scan-scoped finding lists, a dedicated finding-details view, and improved scan-history rendering that makes follow-up actions (pagination, details, matching, comparison) more discoverable.
Changes:
- Introduces
codex-security findings list/findings showflows (plusfindingsdefaulting tolist) and enhancesscans showto support a “latest completed scan” default. - Extends the TypeScript renderer to format saved-findings pages and full finding details (locations, evidence, remediation guidance, history links, pagination hints).
- Expands the bundled Python workbench to support
get-finding, richer scan-history scoping for moved/nested checkouts, and global findings indexing improvements (including secondary-location search).
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk/typescript/tests-ts/workbench-findings-index.test.ts | Adds regression coverage for global findings indexing (scoping, filtering, coverage-read behavior, tamper/noncanonical handling, detail vs preview completeness). |
| sdk/typescript/tests-ts/scan-history-renderer.test.ts | Adds renderer coverage for actionable findings/history output, pagination hints, triage precedence, and next-command suggestions. |
| sdk/typescript/tests-ts/runtime.test.ts | Adds coverage ensuring large get-finding responses are allowed while oversize non-detail workbench responses fail safely without leaking content. |
| sdk/typescript/tests-ts/cli.test.ts | Updates CLI manifest assertions for new findings commands and revised scans show signature. |
| sdk/typescript/tests-ts/cli-findings.test.ts | Adds CLI tests for repository scoping, paging/filter validation, scan selection, and “latest scan” behavior. |
| sdk/typescript/src/scan-history-renderer.ts | Implements new findings/finding render modes, checkout scoping helpers, and improved list/show guidance (pagination, matching, compare suggestions). |
| sdk/typescript/src/runtime.ts | Adds separate workbench stdout limits for list-style commands vs get-finding, with safer maxBuffer error redaction. |
| sdk/typescript/src/cli.ts | Adds findings list/show commands, defaults findings/scans to list, and supports scans show without an explicit scan ID (latest completed). |
| sdk/typescript/README.md | Documents the new scan-history and findings browsing commands and how to page/filter results. |
| sdk/typescript/_bundled_plugin/scripts/workbench_scan_history.py | Improves repository scoping to handle moved checkouts, nested boundaries, and reused paths more safely; includes currentTargetPath projection. |
| sdk/typescript/_bundled_plugin/scripts/workbench_native_indexes.py | Adds multi-target support, legacy-path support, and secondary-location searching for global findings queries. |
| sdk/typescript/_bundled_plugin/scripts/workbench_db.py | Adds get-finding, supports full-details finding serialization, and strips forged metadata fields from stored details while preserving authoritative triage. |
| sdk/typescript/_bundled_plugin/scripts/workbench_cli.py | Extends the workbench CLI surface with get-finding and multi-valued --target-id/--target-path for global findings. |
| README.md | Updates top-level docs to mention scans show latest behavior and the new findings browsing commands. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 223ecf3e75
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0dc21af02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 36196d8552
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7a00cd90b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 94d3e467b2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 54d4964db0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
zcrab-oai
left a comment
zcrab-oai
left a comment
There was a problem hiding this comment.
One concrete historical-finding identity issue remains; details are in the inline comment.
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bfc7da4f1e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ), | ||
| } | ||
| ) | ||
| combined.extend(active.values()) |
There was a problem hiding this comment.
When a pre-target migration database has the same finding ID in multiple targetless scans and an older occurrence was closed, this fallback appends the latest active row without aggregation because _indexed_findings inner-joins security_targets. The finding consequently reappears as open and loses its known-scan history even though its occurrenceCount includes the older occurrence; saved semantic matches between legacy scans have the same problem. Include targetless occurrences in aggregation using a repository-path-scoped identity rather than returning them only through this fallback.
AGENTS.md reference: sdk/typescript/AGENTS.md:L16-L16
Useful? React with 👍 / 👎.
| "confirmed_in_latest_scan": ( | ||
| completed_scans[0]["id"] == row["scan_id"] if completed_scans else True |
There was a problem hiding this comment.
When an upgraded database contains completed scans created before the sealed-manifest migration, their seal_manifest_digest remains NULL until each scan is explicitly backfilled, so they are absent from completed_scans_by_target even though their occurrences are still queried below. If a later such scan omits an older finding, this fallback reports the old occurrence as confirmedInLatestScan: true; use all completed scans to determine confirmation while restricting only coverage reads to sealed scans.
AGENTS.md reference: sdk/typescript/AGENTS.md:L23-L23
Useful? React with 👍 / 👎.
Summary
Add repository-scoped historical finding discovery while preserving checkout ownership, finding triage, and completed-scan integrity.
Changes
Testing
pnpm --pm-on-fail=ignore run typespassed.pnpm --pm-on-fail=ignore run formatpassed.git diff --cached --checkpassed.Risk and rollout
This extends saved-history commands and bundled workbench indexes. Existing credential handling, scan execution, completed artifacts, checkout ownership verification, stored statuses, and sealed-artifact rejection remain unchanged. No database migration or release-version change is required.
Public disclosure review