Skip to content

fix: report completion within the requested scope - #586

Open
mldangelo-oai wants to merge 25 commits into
mainfrom
mdangelo/codex/scoped-scan-completion
Open

fix: report completion within the requested scope#586
mldangelo-oai wants to merge 25 commits into
mainfrom
mdangelo/codex/scoped-scan-completion

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

Scoped scans now judge completion against what the user asked to scan. A scan can finish successfully when every requested path was reviewed, even if the request excluded the rest of the repository. Unfinished requested work and essential in-scope proof gaps remain partial and keep exit code 2.

Changes

  • Define completeness relative to the requested scope across the coverage schema, scan guidance, and finalization flow.
  • Present requested paths, exclusions, blockers, and optional follow-up consistently in CLI output, reports, history details, and SARIF.
  • Keep SARIF findings for incomplete scans while marking execution successful only for complete coverage.
  • Quote ambiguous paths and visibly distinguish invisible, version-sensitive, and canonically equivalent Unicode spellings without changing the original path.
  • Store verified coverage with completed scan history without loading unrelated findings, while preserving stdin transport for large workbench payloads.
  • Refresh the bundled plugin to 0.1.23 and keep generated models, package contents, examples, and custom-validation workflow pins aligned.

Testing

  • Changed and integration-adjacent suites under Python 3.10.20: 493 passed, 11 Windows-only tests skipped, 0 failed.
  • Git 2.43 and jq integration suites: 75 passed, 1 Windows-only test skipped, 0 failed.
  • Broad seeded SDK run: 1,602 passed and 28 platform tests skipped before environment and integration failures were isolated. The integration failures were fixed and rerun above; one unrelated Linux sandbox probe remains unavailable because the test host disables nested user namespaces.
  • pnpm run types: passed.
  • pnpm run format: passed.
  • python3 -m py_compile _bundled_plugin/scripts/report_projection.py: passed.
  • pnpm run build: passed.
  • pnpm pack and node scripts/check-package.mjs <tarball>: passed for 259 package entries, including the public import, NodeNext types, CLI, 111 bundled plugin files, bundled Codex version, and a nested worker without a global Codex executable.
  • Bundled MCP inspection: preserved stdin transport, unbounded response handling, and requested-scope schema parity.

Risk and rollout

This adds no command, flag, environment variable, default, or exit code. JSON retains exact path strings; only human presentation changes for ambiguous paths. A scan still cannot claim complete coverage when requested work or an essential in-scope proof gap remains. There is no database migration, schema-version change, or rewrite of existing reports. The bundled plugin version change follows the normal release flow.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@github-actions github-actions Bot added the bug Something isn't working label Aug 20, 2026
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head, f7ca16c. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 20, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-22T15:07:36.101144Z db6ccfb Manual request
🔒 Security Review Completed 2026-08-21T01:49:31.227949Z 855e95a Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f7ca16c408

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/coverage-presentation.ts Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head, d384888. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d384888a9a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/coverage-presentation.ts Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head, 855e95a. Keep the response suitable for this public repository and do not include private report or task links.

@mldangelo-oai
mldangelo-oai marked this pull request as ready for review August 21, 2026 01:46

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 855e95acd6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/tests-ts/scan-recovery.test.ts Outdated
@mldangelo-oai mldangelo-oai changed the title fix: report completion for the requested scan scope fix: report completion within the requested scope Aug 21, 2026
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the exact current head, 4a377d5. Focus on runtime correctness, requested-scope coverage semantics, the merged stdin transport, and any remaining unnecessary complexity. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a377d56f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/coverage-presentation.ts Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact head 696d996b8dab609899ae518803a4ec2c11b37be9. It includes current main and the Unicode format-control fix. Local types, formatting, focused tests, both full test runs, and package validation pass.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 696d996b8d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/report_projection.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact head 5e7a0de67a7c9fea51bb2643300ee0059a6fba11. It includes current main and fixes the resolved review findings. Focus on runtime correctness, requested-scope and SARIF completion semantics, Unicode-version-independent path rendering, and the merged stdin transports. Exact-head types, formatting, the seeded full suite, focused Python 3.10 coverage, and package validation pass. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 5e7a0de67a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex security review

Please review exact head 5e7a0de67a7c9fea51bb2643300ee0059a6fba11. Focus on requested-scope completion integrity, fail-closed behavior for incomplete coverage, Unicode path ambiguity, SARIF semantics, and the merged stdin transports. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e7a0de67a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

export function formatScopePath(path: string): string {
if (
path.length > 0 &&
!/[\s,;'"\\\u0000-\u001f\u007f-\u009f\p{Cf}\p{Default_Ignorable_Code_Point}]/u.test(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Disambiguate canonically equivalent path spellings

On filesystems that preserve Unicode normalization, such as ext4, distinct requested paths like src/café.ts (U+00E9) and src/café.ts (U+0065 U+0301) are both accepted but rendered identically because this fast path emits combining marks unchanged; the Markdown renderer has the same behavior. Fresh evidence beyond the fixed format-control cases is that canonically equivalent sequences remain raw at the current head, so normalize only for detection and escape the differing code points in both projections to preserve exact path identity.

AGENTS.md reference: sdk/typescript/AGENTS.md:L22-L23

Useful? React with 👍 / 👎.

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact head db6ccfb7dd52dd5353241d790d4aca289865ce72.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db6ccfb7dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".


describe("bundled plugin finding detail contracts", () => {
test("keeps the shipped example report equal to its canonical projection", async () => {
expect(projectFindingDetails({})).toBe(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid snapshotting the entire generated report

Any harmless copy edit anywhere in the generated Markdown now breaks this contract test until the checked-in report is manually synchronized, even when the canonical JSON and report behavior remain correct. Assert the semantic fields or structural markers this test needs instead of byte-for-byte equality with the complete rendered report.

AGENTS.md reference: sdk/typescript/AGENTS.md:L35-L35

Useful? React with 👍 / 👎.

Comment on lines +20 to +23
return JSON.stringify(path).replace(
normalizationSensitive
? /[^\u0020-\u007e]/gu
: /[\u007f-\u009f\u2028\u2029\p{Cf}\p{Default_Ignorable_Code_Point}]/gu,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Escape non-ASCII whitespace in scope paths

When a requested filename contains non-ASCII whitespace such as U+00A0, U+2007, or U+202F, the initial \s check selects JSON quoting, but this replacement set leaves the whitespace literal; the Python Markdown projection does the same. Consequently paths such as src/a b.ts and the distinct src/a<U+00A0>b.ts render visually identically in summaries and reports. Fresh evidence beyond the previously fixed format and normalization cases is that these separator characters remain unescaped in both current renderers; escape all non-ASCII whitespace in both projections.

AGENTS.md reference: sdk/typescript/AGENTS.md:L22-L23

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant