feat: preserve finding relationships in scan history

[mldangelo-oai]

Summary

Teach the existing SQLite workbench to store related findings and reuse confirmed finding links. This is the first feature PR split from #567. The existing matcher and CLI still work on this branch; #575 adds the new matcher on top.

Changes

• Accept an optional related list alongside confirmed and uncertain matches. Related findings stay separate. Invalid results cannot replace a saved comparison.
• Follow stable finding IDs and confirmed links when showing older comparisons. Keep uncertainty and coverage rules, and hide an old related label if the findings are later confirmed to be the same bug.
• Return confirmed finding groups to callers preparing a new comparison. Reuse saved links even when the original scan files are unavailable. Forced matching can ignore earlier model decisions.
• Send large comparison results through UTF-8 standard input. Older custom plugins still receive the original command-line JSON format with confirmed and uncertain matches.
• Add two database indexes and read saved links in batches. Use SQLite's saved links for confirmed groups instead of rebuilding the same links from JSON.
• Reuse the same Python test helper instead of repeating subprocess setup.

The old workbench rejects the new related field, so this PR needs to land before the new matcher is enabled. It does not change the public CLI commands or call an LLM.

Testing

How to test in QA

From the repository root:

cd sdk/typescript
pnpm install --frozen-lockfile
bun test --timeout 30000 tests-ts/workbench-scan-history.test.ts tests-ts/publication-store.test.ts tests-ts/runtime.test.ts tests-ts/scan-comparison.test.ts tests-ts/cli-workbench.test.ts

These tests use synthetic in-memory databases and temporary scan history. They check upgrades, both JSON transports, older plugins, invalid-result rollback, cached comparisons, incomplete coverage, and batched lookups. They also run the existing matcher and CLI against the new workbench. No credentials or network are needed.

Checks run at 02a2e338:

• The five-file compatibility suite passed: 184 tests, with 12 platform-specific skips and the normal 30-second timeout.
• Type checks, formatting, Ruff, the build, and git diff --check passed.
• With test: run MCP contract checks with Node #573 and feat: match repeated findings across scans #575 applied in merge order, both full SDK runs passed: 1,503 tests and 23 skips each. The seeds were 12345 and 1885190066.
• Three fresh native Codex reviews and a separate verifier found no actionable issues.
• The previous head passed GitHub CI and Codex review at cd4b7a67c7.

Risk and rollout

The database migration adds indexes without rewriting saved comparisons or scan artifacts. Building the indexes can hold the normal database write lock on a large history. Older plugins need an upgrade to save related links or results too large for command-line arguments. The existing input format remains supported.

Merge this PR before #575. The independent MCP test cleanup in #573 can merge first.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the current head, cd4b7a67c7c729fac3e4ccc1c33c963abe974374. This is the scan-history storage and compatibility portion of #567. The existing matcher remains in place on this branch.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: cd4b7a67c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

The description now includes the final QA results and merge order. Please review the current head, cd4b7a67c7c729fac3e4ccc1c33c963abe974374. The code has not changed since the earlier review.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: cd4b7a67c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-20T12:22:58.767407Z	02a2e33	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

Please review the current head, 02a2e338f9f515a7a7d76d38a17e238bcbd32be0. The PR description includes the latest cleanup and QA results.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 02a2e338f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".