feat(cli): browse historical security findings - #275
Conversation
…gs-history-discovery
…gs-history-discovery
|
@codex review |
There was a problem hiding this comment.
Pull request overview
This PR adds first-class CLI support for browsing historical scan findings, including repository-scoped and scan-scoped finding lists, a dedicated finding-details view, and improved scan-history rendering that makes follow-up actions (pagination, details, matching, comparison) more discoverable.
Changes:
- Introduces
codex-security findings list/findings showflows (plusfindingsdefaulting tolist) and enhancesscans showto support a “latest completed scan” default. - Extends the TypeScript renderer to format saved-findings pages and full finding details (locations, evidence, remediation guidance, history links, pagination hints).
- Expands the bundled Python workbench to support
get-finding, richer scan-history scoping for moved/nested checkouts, and global findings indexing improvements (including secondary-location search).
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk/typescript/tests-ts/workbench-findings-index.test.ts | Adds regression coverage for global findings indexing (scoping, filtering, coverage-read behavior, tamper/noncanonical handling, detail vs preview completeness). |
| sdk/typescript/tests-ts/scan-history-renderer.test.ts | Adds renderer coverage for actionable findings/history output, pagination hints, triage precedence, and next-command suggestions. |
| sdk/typescript/tests-ts/runtime.test.ts | Adds coverage ensuring large get-finding responses are allowed while oversize non-detail workbench responses fail safely without leaking content. |
| sdk/typescript/tests-ts/cli.test.ts | Updates CLI manifest assertions for new findings commands and revised scans show signature. |
| sdk/typescript/tests-ts/cli-findings.test.ts | Adds CLI tests for repository scoping, paging/filter validation, scan selection, and “latest scan” behavior. |
| sdk/typescript/src/scan-history-renderer.ts | Implements new findings/finding render modes, checkout scoping helpers, and improved list/show guidance (pagination, matching, compare suggestions). |
| sdk/typescript/src/runtime.ts | Adds separate workbench stdout limits for list-style commands vs get-finding, with safer maxBuffer error redaction. |
| sdk/typescript/src/cli.ts | Adds findings list/show commands, defaults findings/scans to list, and supports scans show without an explicit scan ID (latest completed). |
| sdk/typescript/README.md | Documents the new scan-history and findings browsing commands and how to page/filter results. |
| sdk/typescript/_bundled_plugin/scripts/workbench_scan_history.py | Improves repository scoping to handle moved checkouts, nested boundaries, and reused paths more safely; includes currentTargetPath projection. |
| sdk/typescript/_bundled_plugin/scripts/workbench_native_indexes.py | Adds multi-target support, legacy-path support, and secondary-location searching for global findings queries. |
| sdk/typescript/_bundled_plugin/scripts/workbench_db.py | Adds get-finding, supports full-details finding serialization, and strips forged metadata fields from stored details while preserving authoritative triage. |
| sdk/typescript/_bundled_plugin/scripts/workbench_cli.py | Extends the workbench CLI surface with get-finding and multi-valued --target-id/--target-path for global findings. |
| README.md | Updates top-level docs to mention scans show latest behavior and the new findings browsing commands. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 223ecf3e75
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0dc21af02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41fe5e2fe4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 26017ffa9e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 884a7c3a7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 982cd40ff2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 534d555e2f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
Add repository-scoped historical finding discovery while preserving checkout ownership, finding triage, and completed-scan integrity.
Changes
nextOffset.Testing
./node_modules/.bin/tsc --noEmitpassed../node_modules/.bin/prettier --check tests-ts/workbench-findings-index.test.tspassed.git diff --checkpassed.Risk and rollout
This extends saved-history commands and bundled workbench indexes. Existing credential handling, scan execution, completed artifacts, checkout ownership verification, stored statuses, and sealed-artifact rejection remain unchanged. No database migration or release-version change is required.
Public disclosure review