Skip to content

fix(cli): refresh scan progress from saved state - #1757

Merged
mldangelo-oai merged 9 commits into
mainfrom
fix/live-scan-progress
Oct 20, 2026
Merged

mldangelo-oai merged 9 commits into
mainfrom
fix/live-scan-progress

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Oct 19, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Local standard and diff scans can remain on “preflight” when model output contains no new progress markers. Poll saved scan state so the CLI updates its phase and review counts while the scan runs.

Changes

  • Reuse the Deep Scan progress tracker for saved phase and coverage updates, with cancellation and nonfatal read failures.
  • Show review counts separately from file counts in terminal and headless output. Keep worker-local phases from advancing the whole scan.
  • Preserve hosted progress and follow-up worker notifications, update the hosted event schema, and include the renamed module in the npm package.
  • Isolate the hosted-progress test from machine-specific Python discovery. Cover polling cleanup before follow-up turns after successful and failed primary scans, and before repository reconciliation even without a follow-up prompt.

Testing

  • Full SDK API suite: 256 tests passed; four Windows-only cases skipped on macOS. The six reconciliation scenarios reproduced active polling before the fix and pass with it.
  • Saved scan and Deep Scan progress suites: 16 tests and 24 assertions passed.
  • SDK and MCP type checks, plugin bundle build, changed TypeScript formatting, and diff checks passed.
  • Fresh hosted CI and Codex/Copilot reviews will validate the updated head before merge.

Risk and rollout

Adds one saved-state read every five seconds for local standard and diff scans with a progress observer. Polling stops at completion or cancellation and before separate validation, follow-up turns, or repository reconciliation. Existing file-count fields remain available; review counts are optional. No command or flag changes.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@github-actions github-actions Bot added the bug Something isn't working label Oct 19, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-20T01:28:56.034481Z 6edb860 Manual request
🔒 Security Review ✅ Completed 2026-10-20T01:28:16.985140Z 6edb860 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@alandelong-oai alandelong-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Owner-level merge-safety review of b254f1e6a1839b514c685dd4742dbf1527e79be7 completed across all 17 changed files and the workbench/CLI/hosted callers. Reusing the poller and keeping review counts separate from file coverage addresses the missing-marker behavior. I found no actionable issue.

Builds, types and formatting passed, as did 156 tracker/parser/dashboard tests and the installed archive probe for module loading, CLI output and review-only updates. Five focused API/validation cases and protected hosted/package fixtures hit the existing local filesystem restrictions. The hosted merge has an identical tree and passes the full Node24 installed-package smoke, including hosted and real Deep Scan lifecycle checks; two Ubuntu shards pass 2,976 tests. Other CI shards are still running, so this is not a claim that the complete suite has passed.

@alandelong-oai alandelong-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the update. I completed an owner-level merge-safety and simplification review of 1590c428d956aa3e420f453f51516d4e5f28e106 and found no actionable issues. The test isolation and schema-test extraction preserve the reviewed progress behavior.

Fresh builds, types, formatting, source checks, 156 progress/dashboard tests, 179 Python tests (plus 148 subtests), and the rebuilt installed-package progress probe passed. Six focused API/CLI cases passed; four hit the local filesystem ownership restriction. Those four pass in the successful CI merge run, which also validates the installed-package lifecycle. That run includes newer main changes, so it is integration evidence rather than an identical-head suite run.

Copy link
Copy Markdown
Collaborator Author

@codex review

Updated head: b6b5891c4643af41854904d85a2cba9af47bffd0.

Resolved the main conflict by retaining the schema and writeup-recovery tests already extracted on main, removing the duplicate extraction. The progress implementation merged cleanly. Included the reviewed shared fixture repairs from #1763.

Passed locally: 182 Python tests and 151 subtests, formatting of merged SDK files, direct source compatibility checker, and diff checks. SDK tests could not start because locked dependencies are unavailable; the five portable commands were attempted in order but pinned Ruff/dependency setup remains blocked. Full hosted CI is required before merge.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: b6b5891c46

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Shared asynchronous lifecycle changes still have an unresolved polling issue, and full-suite CI validation remains pending.

1 open issue
What changed in this PR

Refreshes local scan progress from saved state so the CLI can update without model progress markers.

Changes:

  • Reuses the progress tracker for saved phases and review counts.
  • Distinguishes reviews from files in terminal, headless, and hosted output.
  • Updates lifecycle tests, packaging, and shared test fixtures.
File Description
sdk/​typescript/​tests-ts/​scan-progress.test.ts Tests saved progress parsing and refreshes.
sdk/​typescript/​tests-ts/​scan-dashboard.test.ts Tests separate review counts.
sdk/​typescript/​tests-ts/​publish.test.ts Removes an unused import.
sdk/​typescript/​tests-ts/​multiscan.test.ts Uses completed-scan fixtures.
sdk/​typescript/​tests-ts/​hosted-scan.test.ts Tests hosted review-count events.
sdk/​typescript/​tests-ts/​deep-progress.test.ts Uses the shared tracker.
sdk/​typescript/​tests-ts/​custom-validation.test.ts Tests validation phase transitions.
sdk/​typescript/​tests-ts/​cli.test.ts Tests headless review updates.
sdk/​typescript/​tests-ts/​api.test.ts Covers progress routing and lifecycle behavior.
sdk/​typescript/​src/​worker-progress.ts Adds review counts and display selection.
sdk/​typescript/​src/​scan-progress.ts Introduces shared saved-state polling.
sdk/​typescript/​src/​scan-executor.ts Accepts hosted review counts.
sdk/​typescript/​src/​scan-dashboard.ts Displays review counts separately.
sdk/​typescript/​src/​index.ts Updates the progress type export.
sdk/​typescript/​src/​deep-progress.ts Removes the replaced tracker module.
sdk/​typescript/​src/​cli.ts Formats and deduplicates review updates.
sdk/​typescript/​src/​api.ts Integrates polling and parent-phase tracking.
sdk/​typescript/​scripts/​package-dist-files.mjs Packages the renamed module.
sdk/​typescript/​docs/​hosted-scans.md Documents optional review counts.
plugins/​codex-security/​mcp-app/​tests/​test_deep_scan_executor.ts Uses extracted fixture helpers.
plugins/​codex-security/​mcp-app/​tests/​support/​fake-codex-fixture.ts Provides shared fake-executor fixtures.

Review effort: Balanced

Comment thread sdk/typescript/src/api.ts Outdated

@alandelong-oai alandelong-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I completed an owner-level merge-safety review of b6b5891c4643af41854904d85a2cba9af47bffd0. I would fix the existing failure-path follow-up issue before merging. When the primary scan fails, a five-second poll or an already pending read can still emit scan progress during postScanPrompt. Stop the tracker before that follow-up and add a failed-primary-scan lifecycle test.

A targeted probe using the exact failure-follow-up block and real tracker reproduced both cases; stopping first suppressed both. This was not a full API end-to-end run. I found no additional actionable issues.

Types, formatting, builds, portable source checks, 156 progress/dashboard tests, 99 publication tests, and the rebuilt installed-package progress probe passed. Full local SDK runs did not pass: protected fixtures hit the environment ownership restriction, and broader runs stopped at a cancellation assertion and temporary Git fixture failure. Current CI is still running.

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review 11c6316317c68fd9a47921c34e2a862dfa66875f, which addresses the failure-path progress-polling lifecycle issue raised in review. The follow-up now stops the tracker before its first turn, with regression coverage for successful and failed primary scans. Hosted CI remains required before merge.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 11c6316317

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Saved-state polling remains active during post-completion matching when no earlier stop occurs.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Medium severity Stop scan polling before post-scan finding reconciliation

sdk/​typescript/​src/​api.ts:2765

Without a post-scan prompt (or an earlier custom-validation stop), polling continues into repository finding reconciliation at lines 2858–2907. Matching can run additional model turns, so the completed scan keeps launching get-scan reads every five seconds until matching finishes. Move this stop before the conditional so polling ends before post-scan work even when no follow-up prompt is configured.

1 resolved since last review

Review effort: Balanced

@alandelong-oai alandelong-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing the failed-scan follow-up. I completed an owner-level merge-safety and simplification review of 11c6316317c68fd9a47921c34e2a862dfa66875f and found no material unresolved issue. The failure path now stops polling before post-scan instructions and preserves the primary failure.

The failed-primary API regression passed. A separate probe of the exact failure-follow-up block with the real tracker also suppressed timer and in-flight updates. Fresh builds, types, formatting, portable checks, 156 progress/dashboard tests, 190 Python tests (plus 183 subtests), and rebuilt installed-package progress/CLI checks passed.

Four focused completion/hosted cases and the custom-validation progress case hit the local filesystem ownership guard. Broad local suites did not pass: they stopped at that guard and a Cloud-publication cancellation assertion. Current CI remains pending, so this approval does not claim a complete suite pass.

Copy link
Copy Markdown
Collaborator Author

Integrated main in a51aab6 after Windows shard 1 reached the old 25-minute job timeout. This brings in the merged 40-minute CI budget and Windows credential handling without changing the progress implementation. The earlier polling-cleanup review thread is resolved. Updated-file formatting and diff checks pass; fresh hosted CI is pending.

@codex review

Please review the updated head and main integration.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: a51aab6cdd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Asynchronous polling and scan lifecycle changes still need successful current-head CI validation.

No open issues 🎉

Review effort: Balanced

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Updated head: 6edb860.

Addressed the earlier Copilot overview finding: saved-state polling now stops before repository reconciliation even when no post-scan prompt is configured. All six existing reconciliation scenarios reproduced the bug before the one-line lifecycle change.

The full API suite passes with 256 tests and four Windows-only skips; 16 progress tests also pass. SDK/MCP type checks, plugin build, formatting, and diff checks pass. Please review the updated lifecycle and regression coverage.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 6edb860c73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No blocking issues remain in progress routing, polling cleanup, or compatibility; automated checks were not rerun.

No open issues 🎉

Review effort: Balanced

@alandelong-oai alandelong-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking findings in this owner-level merge-safety and simplification review of all 17 changed files. Thanks for stopping saved-state polling before repository reconciliation even when no follow-up prompt is configured. Successful and failed follow-ups, custom validation, and hosted progress remain consistent.

Fresh validation passed 438 affected tests in fixed-seed and randomized orders (four platform skips), including the full 256-test API suite, plus 13 independent lifecycle/concurrency probes. Builds, types, formatting and portable source checks passed.

The full SDK suite was not rerun locally. Current merge CI passes Linux/macOS test shards and installed-package checks; four Windows shards remain pending. That merge includes newer main changes.

@mldangelo-oai
mldangelo-oai merged commit 0534445 into main Oct 20, 2026
133 of 138 checks passed
@mldangelo-oai
mldangelo-oai deleted the fix/live-scan-progress branch October 20, 2026 02:25
@github-actions github-actions Bot mentioned this pull request Oct 20, 2026
3 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants