feat: match repeated findings across scan history - #575
Conversation
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review The description now includes the final QA results and merge order. Please review the current head, |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…odex/match-repeated-findings
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3d4a5661b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…iew-575-f533 # Conflicts: # sdk/typescript/src/cli.ts
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
mldangelo-oai
changed the title
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 043fa2a80c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (input.before.length === 0 || input.after.length === 0) { | ||
| return { matches: [], uncertain: [] }; | ||
| } | ||
| const known = reconcileComparison( |
There was a problem hiding this comment.
The newly exported SDK accepts imported finding arrays without verifying that occurrenceId values are unique across both sides. If malformed before/after documents reuse an ID for unrelated findings, groupFindings treats them as the same occurrence node, so this initial reconciliation can set known.complete and return a high-confidence match without consulting the model. Validate nonempty, globally unique occurrence IDs before reconciling to prevent unrelated scan history from being merged.
AGENTS.md reference: sdk/typescript/AGENTS.md:L22-L24
Useful? React with 👍 / 👎.
| export type { ScanCost, ScanSessionEvent } from "./cost.js"; | ||
| export type { CustomValidationResult } from "./custom-validation.js"; | ||
| export type { ScanActivity, ScanActivityStatus } from "./scan-activity.js"; | ||
| export { matchScanFindings } from "./scan-comparison.js"; |
There was a problem hiding this comment.
When an SDK caller follows the new documented flow and sets workingDirectory to the scanned repository, Codex automatically loads applicable repository AGENTS.md files as developer instructions. Exporting matchScanFindings in this state lets repository-controlled instructions outrank the prompt's untrusted-data warning and steer high-confidence matches; callers that persist the result can then corrupt scan history. Disable project-document loading for comparison threads or use an instruction-free working directory before exposing this matcher.
AGENTS.md reference: sdk/typescript/AGENTS.md:L8-L12
Useful? React with 👍 / 👎.
2 participants
Summary
Replace the all-at-once matcher behind
scans matchandscans comparewith a paged catalogue that reuses stable finding identities and requests full evidence only when needed.This PR is stacked on #574. It adds a public SDK matcher but no CLI commands, flags, accepted values, or default changes. It uses the existing Codex authentication and adds no service.
Changes
matchScanFindingswith self-contained public input, result, progress, and cancellation types.--max-costto an explicitscans match --allrun.Testing
At
043fa2a80cbfe13cc9ae640339ce92dcb60e9d63:12345, run in balanced batches: 1,646 passed, 30 platform or integration skips, 0 failed.git diff --check, and the SDK build passed.Risk and rollout
Merge #574 first, then retarget this PR to
main.A wrong confirmed match can affect later comparisons. Existing saved comparisons are not rewritten on upgrade; use
scans match --all --forceto revisit an earlier result. Paging respects the upstream message limit but does not establish matching accuracy or provide unlimited context.With
--max-costormaxCostUsd, matching that needs more context is deferred instead of saving a partial result or making extra automatic calls.Public disclosure review
Known historical exceptions: earlier commits retain a work email address in Git metadata, and existing automated review comments link to an authenticated Codex settings page. This update adds no new sensitive material.