Skip to content

fix(cli): allow scan options during interactive bulk discovery #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dipeshbabu wants to merge 2 commits into
base: main
Choose a base branch
from
+58 −3
Open

fix(cli): allow scan options during interactive bulk discovery #175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0ba7351
Allow scan options during bulk discovery
dipeshbabu Jul 31, 2026
77d0376
Merge upstream main into interactive bulk options
dipeshbabu Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions sdk/typescript/src/cli.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1382,6 +1382,11 @@ export async function main(
let outputDir: string;
let githubHost: string | undefined;
if (args.input === undefined) {
if (options.outputDir !== undefined) {
Comment on lines 1384 to +1385

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep prefixed bulk scans behind the container guard

When the customer image is invoked with a global Incur option before the command, such as docker run -it … --format toon bulk-scan --workers 8, docker/entrypoint.sh:5-10 misses the command because it only checks whether $1 is bulk-scan. This replacement validation only rejects --output-dir, so the invocation now reaches runBulkScanWizard; the removed argv[0] check previously rejected it. With a gh executable/auth made available to the container, this enables the interactive discovery flow that the entrypoint explicitly prohibits. Either locate bulk-scan after supported global options in the entrypoint or retain an equivalent CLI-side container guard.

Useful? React with 👍 / 👎.

throw new Error(
"--output-dir can only be used with a repository CSV; omit it to choose an output directory interactively.",
);
}
let optionIndex = 1;
while (optionIndex < argv.length) {
const argument = argv[optionIndex]!;
Expand All @@ -1390,15 +1395,25 @@ export async function main(
argument === "--effort" ||
argument === "--provider" ||
argument === "--codex" ||
argument === "--knowledge-base"
argument === "--knowledge-base" ||
argument === "--workers" ||
argument === "--mode" ||
argument === "--max-attempts" ||
argument === "--plugin-path" ||
argument === "--python"
) {
optionIndex += 2;
} else if (
argument.startsWith("--model=") ||
argument.startsWith("--effort=") ||
argument.startsWith("--provider=") ||
argument.startsWith("--codex=") ||
argument.startsWith("--knowledge-base=")
argument.startsWith("--knowledge-base=") ||
argument.startsWith("--workers=") ||
argument.startsWith("--mode=") ||
argument.startsWith("--max-attempts=") ||
argument.startsWith("--plugin-path=") ||
argument.startsWith("--python=")
) {
optionIndex += 1;
} else {
Expand All @@ -1407,7 +1422,7 @@ export async function main(
}
if (argv[0] !== "bulk-scan" || optionIndex !== argv.length) {
throw new Error(
"Run 'codex-security bulk-scan [--provider PROVIDER] [--model MODEL] [--effort EFFORT] [--codex KEY=VALUE] [--knowledge-base PATH]' to discover repositories, or provide a CSV and --output-dir.",
"Run 'codex-security bulk-scan [--provider PROVIDER] [--model MODEL] [--effort EFFORT] [--workers COUNT] [--mode MODE] [--max-attempts COUNT] [--plugin-path PATH] [--python PATH] [--codex KEY=VALUE] [--knowledge-base PATH]' to discover repositories, or provide a CSV and --output-dir.",
);
}
const wizard = await runBulkScanWizard(
Expand Down
40 changes: 40 additions & 0 deletions sdk/typescript/tests-ts/cli.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -888,6 +888,12 @@ describe("CLI", () => {
["bulk-scan", "--codex", 'model_reasoning_effort="high"'],
["bulk-scan", '--codex=model_reasoning_effort="high"'],
["bulk-scan", "--model", "gpt-5.6-terra", "--effort", "high"],
["bulk-scan", "--workers", "8"],
["bulk-scan", "--workers=8"],
["bulk-scan", "--mode", "deep"],
["bulk-scan", "--max-attempts=3"],
["bulk-scan", "--plugin-path", "./plugin"],
["bulk-scan", "--python=python3"],
["bulk-scan", "--knowledge-base", "/shared/threat-models"],
[
"bulk-scan",
Expand Down Expand Up @@ -928,6 +934,22 @@ describe("CLI", () => {
}
});

test("rejects prefixed interactive bulk scans before discovery", async () => {
const stdout = capture();
const stderr = capture();

expect(
await main(
["--format", "toon", "bulk-scan", "--workers", "8"],
stdout.stream,
stderr.stream,
dependencies(),
),
).toBe(2);
expect(stdout.text()).toBe("");
expect(stderr.text()).toContain("Run 'codex-security bulk-scan");
});

test("requires an output directory for a supplied bulk scan CSV", async () => {
const stdout = capture();
const stderr = capture();
Expand All @@ -944,6 +966,24 @@ describe("CLI", () => {
expect(stdout.text()).toBe("");
});

test("lets the discovery wizard choose its output directory", async () => {
const stdout = capture();
const stderr = capture();

expect(
await main(
["bulk-scan", "--output-dir", "results"],
stdout.stream,
stderr.stream,
dependencies(),
),
).toBe(2);
expect(stderr.text()).toContain(
"--output-dir can only be used with a repository CSV",
);
expect(stdout.text()).toBe("");
});

test("exposes only typed, read-only SDK metadata over MCP", () => {
const child = spawnSync(
process.execPath,
Expand Down