perf(workbench): reuse ordinary scan context results

[mldangelo-oai]

Summary

Avoid constructing the same workbench scan result twice for every ordinary scan-context request.

Changes

• Reuse the scan result already produced while assembling workspace state.
• Preserve the separate selected-finding result when a requested occurrence lies outside the normal findings page.
• Add a real-workbench regression with 21 findings that verifies result construction counts and off-page finding visibility.

Testing

• bun test --timeout 30000 tests-ts/scan-recovery.test.ts — 29 passed.
• bun test --timeout 30000 tests-ts/compact-diff-scan.test.ts — 5 passed.
• pnpm --pm-on-fail=ignore run types — passed.
• pnpm --pm-on-fail=ignore exec prettier --check tests-ts/scan-recovery.test.ts — passed.
• Python AST parsing and git diff --check — passed.

Risk and rollout

Low risk. Ordinary JSON responses preserve the same scan and workspace results while avoiding duplicate database, artifact, and finding work. Explicit occurrence selection continues to build a separate result so off-page findings are not lost.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 429ad169fc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 429ad169fc

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ting-hong-shieh]

Approved on exact head 429ad169fc867e707cbaada00a02825804174932 against main 216212b70a421b0bf30319d241de47a64050ec0f.

I ran the same new 21-finding regression against the base production code and the exact PR head. The structured snapshots were:

• Base: ordinaryCalls=2, selectedCalls=2, ordinaryCount=20, selectedCount=21, workspaceCount=20, selectedIncluded=true.
• Head: ordinaryCalls=1, with every other field unchanged.

This isolates the intended performance change: the ordinary context reuses workspace.results, while an off-page selected finding still receives the separate result that includes all 21 findings.

Exact-head validation on macOS arm64 with Bun 1.3.14 and Python 3.12.13:

• 29 scan-recovery tests and 5 compact-diff tests passed.
• The full SDK suite passed with 1,080 tests, 11 platform/integration skips, and 0 failures.
• Generated-model checking, TypeScript checking, full Prettier checking, build, and git diff --check passed.
• The public exact-head rollup is green across the current Linux, macOS, and Windows matrices.

The local tests used synthetic temporary repositories and fixtures. No model or provider request, external API credential, or real user data was used.

[zcrab-oai]

Looks good. Ordinary scan contexts reuse their existing result while preserving workspace ownership, pagination, and selected off-page findings.