feat(cli): browse historical security findings - #275
Conversation
…gs-history-discovery
…gs-history-discovery
|
@codex review |
There was a problem hiding this comment.
Pull request overview
This PR adds first-class CLI support for browsing historical scan findings, including repository-scoped and scan-scoped finding lists, a dedicated finding-details view, and improved scan-history rendering that makes follow-up actions (pagination, details, matching, comparison) more discoverable.
Changes:
- Introduces
codex-security findings list/findings showflows (plusfindingsdefaulting tolist) and enhancesscans showto support a “latest completed scan” default. - Extends the TypeScript renderer to format saved-findings pages and full finding details (locations, evidence, remediation guidance, history links, pagination hints).
- Expands the bundled Python workbench to support
get-finding, richer scan-history scoping for moved/nested checkouts, and global findings indexing improvements (including secondary-location search).
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk/typescript/tests-ts/workbench-findings-index.test.ts | Adds regression coverage for global findings indexing (scoping, filtering, coverage-read behavior, tamper/noncanonical handling, detail vs preview completeness). |
| sdk/typescript/tests-ts/scan-history-renderer.test.ts | Adds renderer coverage for actionable findings/history output, pagination hints, triage precedence, and next-command suggestions. |
| sdk/typescript/tests-ts/runtime.test.ts | Adds coverage ensuring large get-finding responses are allowed while oversize non-detail workbench responses fail safely without leaking content. |
| sdk/typescript/tests-ts/cli.test.ts | Updates CLI manifest assertions for new findings commands and revised scans show signature. |
| sdk/typescript/tests-ts/cli-findings.test.ts | Adds CLI tests for repository scoping, paging/filter validation, scan selection, and “latest scan” behavior. |
| sdk/typescript/src/scan-history-renderer.ts | Implements new findings/finding render modes, checkout scoping helpers, and improved list/show guidance (pagination, matching, compare suggestions). |
| sdk/typescript/src/runtime.ts | Adds separate workbench stdout limits for list-style commands vs get-finding, with safer maxBuffer error redaction. |
| sdk/typescript/src/cli.ts | Adds findings list/show commands, defaults findings/scans to list, and supports scans show without an explicit scan ID (latest completed). |
| sdk/typescript/README.md | Documents the new scan-history and findings browsing commands and how to page/filter results. |
| sdk/typescript/_bundled_plugin/scripts/workbench_scan_history.py | Improves repository scoping to handle moved checkouts, nested boundaries, and reused paths more safely; includes currentTargetPath projection. |
| sdk/typescript/_bundled_plugin/scripts/workbench_native_indexes.py | Adds multi-target support, legacy-path support, and secondary-location searching for global findings queries. |
| sdk/typescript/_bundled_plugin/scripts/workbench_db.py | Adds get-finding, supports full-details finding serialization, and strips forged metadata fields from stored details while preserving authoritative triage. |
| sdk/typescript/_bundled_plugin/scripts/workbench_cli.py | Extends the workbench CLI surface with get-finding and multi-valued --target-id/--target-path for global findings. |
| README.md | Updates top-level docs to mention scans show latest behavior and the new findings browsing commands. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 223ecf3e75
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f0dc21af02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 4ae549887a
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 570c5cfc21
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: ffce0463f3
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2196b04083
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 7cd25760f8
Only the user who started this review can view the report in Codex.
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7cd25760f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9a5158e1d7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Verification
pnpm run test- 831 passed, 5 expected platform/integration skips, 0 failed (836 tests across 36 files).pnpm run typesandpnpm run format.pnpm pack --pack-destination /tmp/...andpnpm run check:package /tmp/.../openai-codex-security-0.1.5.tgz; verified installation, CLI/SDK exports, and all 95 bundled plugin files.