Skip to content

fix: report completion within the requested scope - #586

Open
mldangelo-oai wants to merge 23 commits into
mainfrom
mdangelo/codex/scoped-scan-completion
Open

fix: report completion within the requested scope#586
mldangelo-oai wants to merge 23 commits into
mainfrom
mdangelo/codex/scoped-scan-completion

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

Scoped scans now judge completion against what the user asked to scan. A scan can finish successfully when every requested path was reviewed, even if the request excluded the rest of the repository. Unfinished requested work and essential in-scope proof gaps remain partial and keep exit code 2.

Changes

  • Define completeness relative to the requested scope across the coverage schema, scan guidance, and finalization flow.
  • Present requested paths, exclusions, blockers, and optional follow-up consistently in CLI output, reports, history details, and SARIF.
  • Keep SARIF findings for incomplete scans while marking execution successful only for complete coverage.
  • Quote ambiguous paths and escape invisible formatting characters without changing the original path.
  • Store verified coverage with completed scan history without loading unrelated findings, while preserving the current stdin transport for large workbench payloads.
  • Refresh the bundled plugin to 0.1.23 and keep recovery tests focused on canonical artifacts instead of generated report headings.

Testing

  • Focused coverage presentation, SARIF export, contract, and recovery tests: 117 passed, 0 failed.
  • Focused Unicode presentation under Python 3.10.20: 4 passed, 0 failed.
  • Final scoped history stdin tests after merging main: 3 passed, 0 failed.
  • pnpm run types: passed.
  • pnpm run format: passed.
  • pnpm run test --seed 12345: 1,569 passed, 29 skipped, 0 failed.
  • pnpm pack and pnpm run check:package <tarball>: passed for 251 package entries, including the public import, NodeNext types, CLI, 111 bundled plugin files, bundled Codex version, and a nested worker without a global Codex executable.
  • Bundled MCP inspection: preserved stdin transport, unbounded response handling, and the requested-scope schema.

Risk and rollout

This adds no command, flag, or exit code. A scan still cannot claim complete coverage when requested work or an essential in-scope proof gap remains. There is no database migration, schema-version change, or rewrite of existing reports. The bundled plugin version change follows the normal release flow.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@github-actions github-actions Bot added the bug Something isn't working label Aug 20, 2026
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head, f7ca16c. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 20, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-21T21:21:56.947082Z 5e7a0de Manual request
🔒 Security Review Completed 2026-08-21T01:49:31.227949Z 855e95a Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f7ca16c408

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/coverage-presentation.ts Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head, d384888. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d384888a9a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/coverage-presentation.ts Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head, 855e95a. Keep the response suitable for this public repository and do not include private report or task links.

@mldangelo-oai
mldangelo-oai marked this pull request as ready for review August 21, 2026 01:46

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 855e95acd6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/tests-ts/scan-recovery.test.ts Outdated
@mldangelo-oai mldangelo-oai changed the title fix: report completion for the requested scan scope fix: report completion within the requested scope Aug 21, 2026
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the exact current head, 4a377d5. Focus on runtime correctness, requested-scope coverage semantics, the merged stdin transport, and any remaining unnecessary complexity. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a377d56f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/src/coverage-presentation.ts Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact head 696d996b8dab609899ae518803a4ec2c11b37be9. It includes current main and the Unicode format-control fix. Local types, formatting, focused tests, both full test runs, and package validation pass.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 696d996b8d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/report_projection.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact head 5e7a0de67a7c9fea51bb2643300ee0059a6fba11. It includes current main and fixes the resolved review findings. Focus on runtime correctness, requested-scope and SARIF completion semantics, Unicode-version-independent path rendering, and the merged stdin transports. Exact-head types, formatting, the seeded full suite, focused Python 3.10 coverage, and package validation pass. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 5e7a0de67a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex security review

Please review exact head 5e7a0de67a7c9fea51bb2643300ee0059a6fba11. Focus on requested-scope completion integrity, fail-closed behavior for incomplete coverage, Unicode path ambiguity, SARIF semantics, and the merged stdin transports. Keep the response suitable for this public repository and do not include private report or task links.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e7a0de67a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

export function formatScopePath(path: string): string {
if (
path.length > 0 &&
!/[\s,;'"\\\u0000-\u001f\u007f-\u009f\p{Cf}\p{Default_Ignorable_Code_Point}]/u.test(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Disambiguate canonically equivalent path spellings

On filesystems that preserve Unicode normalization, such as ext4, distinct requested paths like src/café.ts (U+00E9) and src/café.ts (U+0065 U+0301) are both accepted but rendered identically because this fast path emits combining marks unchanged; the Markdown renderer has the same behavior. Fresh evidence beyond the fixed format-control cases is that canonically equivalent sequences remain raw at the current head, so normalize only for detection and escape the differing code points in both projections to preserve exact path identity.

AGENTS.md reference: sdk/typescript/AGENTS.md:L22-L23

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant