[mldangelo-oai]

Summary

Finding history can report the wrong first and last scan when saved start times use different UTC offsets. Order occurrences by their parsed start instant and use the scan ID to break ties, preserving the original knownSince timestamp text.

Changes

• Reuse the existing timestamp parser when selecting occurrence history bounds.
• Cover mixed offsets, microsecond differences, and equal instants with saved-scan regressions.
• Replace invalid timestamp placeholders in the existing SDK history fixture with RFC 3339 timestamps.

Testing

• Python scan-history module: 43 passed, including three regressions that fail against the original source.
• SDK scan-history module: 9 passed, 36 assertions.
• All five portable plugin checks passed: Ruff lint/format, build:ci, source compatibility, and source-check tests.
• SDK types and formatting checks passed.
• Full SDK suite (pnpm run test --seed 12345 and pnpm run test, random seed 5326350): each run finished with 5,200 passed, 67 skipped, and 11 authentication-fixture failures. Every failure matches the Git-root diagnostic reproduced by focused controls on the unmodified base commit; neither full-suite run passed.

Risk and rollout

No schema migration or stored timestamp rewrite. This uses the existing parser's precision and error behavior: malformed timestamps or mixed timezone-aware and timezone-naive values now surface parser/comparison errors during occurrence-history lookup.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T23:42:41.414242Z	577ef6b	PR opened
🔒 Security Review	✅ Completed 2026-10-19T23:44:12.547248Z	577ef6b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for the focused fix. No blocking findings in this owner-level merge-safety review. The shared timestamp parser brings occurrence bounds into line with the finding index, while preserving original timestamp text and deterministic scan-ID tie breaks.

Validated 28 SDK history/renderer tests with the CI-pinned Bun 1.3.14, 20 real-SQLite occurrence reads covering offsets, microseconds, ties and linked identities, all five portable plugin checks, SDK types/formatting, and the plugin build. The original base produced incorrect bounds in 18 of those SQLite reads. Local saved-scan integration was blocked by existing filesystem ownership validation; the full seeded SDK run was stopped after 111 passes and one such failure, so this is not a full-suite pass.

[Copilot]

🟢 Approval recommended

The narrow change implements the intended ordering with focused regression coverage and no identified blocking issues.

No open issues 🎉

What changed in this PR

Corrects finding-history bounds by ordering scans by parsed start time, breaking ties by scan ID while preserving the original knownSince text.

Changes:

• Reuses the existing timestamp parser for occurrence ordering.
• Adds regressions for mixed offsets, microseconds, and equal instants.
• Replaces SDK fixture placeholders with valid timestamps.

File	Description
sdk/​typescript/​tests-ts/​workbench-scan-history.test.ts	Uses valid timestamps in history fixtures and expectations.
plugins/​codex-security/​tests/​test_workbench_scan_history.py	Adds timestamp-ordering regressions.
plugins/​codex-security/​scripts/​workbench_scan_history.py	Sorts history by parsed instant and scan ID.

_{Review effort: Balanced}