fix(workbench): bind finding excerpts to selected source paths - #488
fix(workbench): bind finding excerpts to selected source paths#488mldangelo-oai wants to merge 16 commits into
Conversation
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review commit |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review commit |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex security review Please review the current head |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review exact head |
|
@codex security review Please review exact head |
mldangelo-oai
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cad99e0640
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if scope["kind"] == "file": | ||
| return scope["objectId"] if not suffix else None | ||
| relative = PurePosixPath(*suffix).as_posix() | ||
| entry = exact_tree_path(repository, scope["objectId"], relative) |
There was a problem hiding this comment.
On a case-insensitive checkout, when a selected directory contains colliding Git entries such as foo.py and FOO.py, this exact lookup trusts whichever spelling the finding reports before attempting the filesystem-backed ambiguity check. Because the working tree can expose only one of those entries, the spelling does not establish which blob was scanned, so sourceExcerpt can display the sibling blob instead; route normalized collisions through the witness check or omit the excerpt.
AGENTS.md reference: sdk/typescript/AGENTS.md:L27-L27
Useful? React with 👍 / 👎.
1 participant
Summary
Bind optional finding source excerpts to the exact Git objects and requested paths recorded when a scan starts. If the scanned bytes are not available as immutable objects, omit the excerpt and keep the finding.
Changes
HEADcontent.0.1.36and verify a cached0.1.25bundle refreshes without losing stored credentials.Testing
Checks on
cad99e064009a02ce28acb452fdc28bc021da31b:pnpm run types,pnpm run format,pnpm run build, Ruff, andgit diff --check: passed.--seed 488): 1,597 passed, 30 platform-specific skips, 0 failed across 88 files.pnpm packand the installed-package checker: passed. The tarball contains 256 entries and the smoke test verified the public import, NodeNext types, CLI, 112 bundled plugin files, bundled Codex, and a nested worker without a global Codex executable.Native Windows end-to-end behavior remains delegated to CI. Hosted checks were not awaited before moving to the next PR.
Risk and rollout
Migration 34 adds a nullable column and does not rewrite existing scan records. Source excerpts remain optional, and an omitted excerpt does not remove the finding. The bundle identity change refreshes cached preview contents but does not publish a package or deploy anything.
Public disclosure review
Existing automated review comments contain requester-only report references. They are not reproduced here, and the second attestation remains unchecked because those comments are already part of the public PR history.