feat: preserve finding relationships in scan history

sdk/typescript/_bundled_plugin/scripts/workbench_cli.py

@@ -163,7 +163,9 @@ def parse_args(description: str) -> argparse.Namespace:
     save_scan_comparison = subparsers.add_parser("save-scan-comparison")
     save_scan_comparison.add_argument("--before-scan-id", required=True)
     save_scan_comparison.add_argument("--after-scan-id", required=True)
-    save_scan_comparison.add_argument("--matches-json", required=True)
+    matches_transport = save_scan_comparison.add_mutually_exclusive_group(required=True)
+    matches_transport.add_argument("--matches-json")
+    matches_transport.add_argument("--matches-json-stdin", action="store_true")
 
     list_global_findings = subparsers.add_parser("list-global-findings")
     list_global_findings.add_argument("--query")
@@ -315,7 +317,13 @@ def parse_args(description: str) -> argparse.Namespace:
             parser.error("pass exactly one user-context transport")
         index = arguments.index("--user-context-stdin")
         arguments[index : index + 1] = ["--user-context", sys.stdin.read()]
-    return parser.parse_args(arguments)
+    parsed = parser.parse_args(arguments)
+    if getattr(parsed, "matches_json_stdin", False):
+        try:
+            parsed.matches_json = sys.stdin.buffer.read().decode("utf-8")
+        except UnicodeDecodeError:
+            parser.error("--matches-json-stdin requires UTF-8 JSON")
+    return parsed
 
 
 def non_negative_int(value: str) -> int:

sdk/typescript/_bundled_plugin/scripts/workbench_db.py

@@ -3203,9 +3203,15 @@ def list_findings(connection: sqlite3.Connection, args: argparse.Namespace) -> d
         values,
     ).fetchone()[0]
     next_offset = args.offset + len(rows)
+    relations = scan_history.finding_relations(
+        connection, scan["id"], (row["id"] for row in rows)
+    )
     return {
         "findingsPage": {
-            "findings": [finding_result(connection, scan, row) for row in rows],
+            "findings": [
+                finding_result(connection, scan, row, related=relations.get(row["id"], []))
+                for row in rows
+            ],
             "limit": limit,
             "nextOffset": next_offset if next_offset < total else None,
             "offset": args.offset,
@@ -3297,14 +3303,20 @@ def scan_result(
             "completed": independent_reviews["completed"],
             "consolidating": independent_reviews["consolidating"],
         }
+    relations = scan_history.finding_relations(
+        connection, scan["id"], (row["id"] for row in occurrence_rows)
+    )
     return {
         "artifacts": artifacts,
         "canceledAt": scan["canceled_at"],
         **scan_usage.stored_scan_cost_fields(scan["cost_json"]),
         "contract": scan_contract(scan),
         "continuationThreadId": scan["continuation_thread_id"],
         "failureMessage": scan["failure_message"],
-        "findings": [finding_result(connection, scan, row) for row in occurrence_rows],
+        "findings": [
+            finding_result(connection, scan, row, related=relations.get(row["id"], []))
+            for row in occurrence_rows
+        ],
         "findingCount": finding_count,
         "findingsTruncated": finding_count > len(occurrence_rows),
         "severityCounts": severity_counts,
@@ -3449,6 +3461,8 @@ def finding_result(
     connection: sqlite3.Connection,
     scan: sqlite3.Row,
     occurrence: sqlite3.Row,
+    *,
+    related: list[dict[str, Any]],
 ) -> dict[str, Any]:
     details = bounded_finding_details(read_finding_details(occurrence["details_json"]))
     confidence = details.get("confidence")
@@ -3513,6 +3527,8 @@ def finding_result(
         result["matches"] = matches
         result["knownSince"] = known_since
         result["knownScanIds"] = known_scan_ids
+    if related:
+        result["related"] = related
     result.pop("artifactPaths", None)
     source_excerpt = finding_source_excerpt(scan, target, locations)
     if source_excerpt: