feat: match repeated findings across scans - #575
Conversation
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review The description now includes the final QA results and merge order. Please review the current head, |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…odex/match-repeated-findings
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3d4a5661b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…iew-575-f533 # Conflicts: # sdk/typescript/src/cli.ts
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
Replace the all-findings-at-once matcher behind the existing
scans matchandscans comparecommands. Complete finding reports can exceed Codex's per-message character limit. The new matcher starts with compact records for known issues and requests full evidence when needed.This is the matcher and SDK part of #567, stacked on #574. It uses the existing Codex authentication and adds no public CLI commands, flags, accepted values, or defaults.
Changes
--forceignore earlier semantic groups while retaining stable identities. Preserve main's failed-history output behavior, including--full-output, alongside the matching cancellation handler.matchScanFindingsand its public input, result, progress, and cancellation types. Cost-limited scans retain the existing allowance of at most one automatic matching call; additional work is deferred toscans match --all.Testing
At
1b1e546213d1a041e3daf03985f24d24b8ade8a8, withmainat7828456bcb3ef13ed26f36143532cfdab54d3483:12345and2895725777: 1,555 passed, 29 platform skips on each completed run.git diff --checkpassed. The package check used a private npm cache after the default cache was not writable.scans matchandscans comparehelp and command schemas are byte-for-byte unchanged from the synchronized storage branch.matchandcomparecommands against a disposable history.The first full local SDK run with seed
12345was stopped after 30-second timeouts in deep-scan/recovery tests and the sealed-history test. All five affected tests then passed in isolation with the normal timeout; the four unchanged tests also passed on the synchronized #574 baseline. The complete retry with the same seed passed.To repeat the focused QA from
sdk/typescript:pnpm install --frozen-lockfile bun test --timeout 30000 tests-ts/finding-catalogue.test.ts tests-ts/scan-comparison.test.ts tests-ts/cli-workbench.test.ts tests-ts/scan-matching-e2e.test.ts tests-ts/workbench-scan-history.test.ts tests-ts/scan-history-renderer.test.ts tests-ts/cli.test.tsThe repeatable tests use synthetic findings and temporary sealed scans. They cover large and Unicode evidence, all final matching outcomes, saved-link reuse, forced matching, cancellation, invalid results, and unchanged scan artifacts.
Risk and rollout
#573 has merged. Merge #574 first. After its squash merge, merge the resulting
maininto this branch, change this PR's base tomain, and rerun the exact-head checks and review. The branch updates are additive.A wrong confirmed match can affect later comparisons. Existing caches are not rewritten on upgrade; use
scans match --all --forceto revisit an earlier partial or incorrect result. Review consequential model judgments. Paging avoids the per-message limit but does not provide unlimited context or establish matching accuracy. Full evidence remains in host memory, and persisted scan-pair results still grow quadratically with the number of scans.Automatic matching may need more context now that each saved pair is complete. With
--max-costormaxCostUsd, that work is deferred instead of saving a partial comparison or making additional automatic calls. The scan total still excludes the existing one-call matching allowance.Public disclosure review