feat(server): add read-only findings dashboard by kmbroai · Pull Request #679 · openai/codex-security

kmbroai · 2026-08-27T07:34:47Z

Summary

Add a read-only dashboard at /dashboard for findings and duplicate groups stored in the findings service, with refreshes every five seconds.

Stacked on #674. This update includes the current parent and canonical plugin source layout while preserving the dashboard's service-owned data boundary. Neither PR is merged into its base.

Changes

Show Findings first, followed by Duplicate groups, using the OpenAI Apps SDK UI design system. Both views support search, repository filtering, sorting, pagination, and record details.
Link findings to stored duplicate groups and groups to member findings, preserving overlapping groups and original finding content.
Read only findings, repository associations, and group membership. Scan/workflow views, progress summaries, stage/status filters, local scan links, and their database projections are absent.
Preserve polling, refresh-error recovery, native keyboard controls, and proxy path prefixes. The dashboard does not start scans, publish findings, deduplicate, modify records, or open paths from finding content.
Package compiled UI assets and dependency notices. Frontend dependencies remain build-only; production dependencies and public CLI flags are unchanged by the dashboard.
Preserve both canonical plugin generation and dashboard asset compilation in Docker/npm builds. Installed-package smoke checks retain dashboard serving, credential locking, and MCP initialization.
Support the dashboard helper's isolated Python imports and existing help check. Dashboard query functions and SQL migrations are unchanged by this integration.

Testing

Current integration at 692daa48:

Focused integration tests: 37 passed, zero failures.
Full SDK suites passed with fixed seed 12345 and randomized seed 3043221333: each had 2,018 passed, 29 skipped, and zero failures.
Canonical plugin generation/source ownership, generated-model consistency, TypeScript checks including MCP, formatting, and git diff --check passed.
Full canonical Python suite: 1,032 passed, 9 skipped, and 103 subtests passed. MCP tests and deterministic triage contract tests passed. Existing migration tuples and dashboard/helper query functions are unchanged.
Docker smoke passed from a tracked source snapshot with no pre-generated host plugin: dashboard serving and stored-data views, publication, checkpoints, group writes, restart persistence, and clean shutdown.
The Docker-built npm archive passed package and installed-consumer checks: 381 entries, including 121 plugin files. Verified public imports, NodeNext types, CLI, credential locking, MCP initialization, bundled Codex, and nested-worker startup without global Codex. Test fixtures are excluded. Dashboard assets and HTTP serving also passed.
Scoped workflow lint passed. The available full-repository linter rejects existing concurrency.queue keys in unrelated release workflows; those files were not changed.
Hosted CI is tracked by the checks attached to the current PR commit; these results describe local verification.

Risk and rollout

Browsing depends only on findings and groups stored in the service; scan and workflow history is not synchronized or required. The dashboard endpoint accepts view=findings (default) or view=groups. It does not expose the scan/workflow views from the earlier PR revision.

The existing service access boundary is unchanged: keep it local or behind an authenticated proxy. Local verification uses Linux and synthetic data/provider responses. Browser visual QA, native Windows execution, and live model reviews were not run locally. This update does not publish images, release packages, or merge PRs.

Public disclosure review

No customer, partner, prospect, or user identities, data, or identifying details are included.
No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

chatgpt-codex-connector · 2026-08-27T07:35:18Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-27T07:37:50.111115Z	`ffe2663`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

…indings-dashboard

zcrab-oai

Three validated findings introduced in this PR: missing canonical dashboard source, full-database polling scans, and stale repository-filter selection.

zcrab-oai · 2026-08-27T21:24:44Z

    "scripts/workbench_feedback.py",
    "scripts/workbench_finding_index.py",
    "scripts/workbench_finding_workflows.py",
+    "scripts/workbench_dashboard.py",


[P1] Add the dashboard helper to canonical plugin source

This manifest now requires scripts/workbench_dashboard.py, but the PR adds that file only under generated sdk/typescript/_bundled_plugin/scripts. Since merged PR #675, plugin generation copies authored files from plugins/codex-security/scripts and fails when a manifest entry has no canonical source. Rebasing this dashboard onto current main will therefore fail SDK build/test/package generation. Add the dashboard helper and related Python changes under the canonical plugin source instead of checking in generated files.

zcrab-oai · 2026-08-27T21:24:44Z

+    findings.created_at AS createdAt, findings.updated_at AS updatedAt
+FROM findings LEFT JOIN (
+    SELECT finding_id, json_group_array(repository_id) AS ids
+    FROM finding_repositories GROUP BY finding_id


[P2] Avoid materializing every repository association on each dashboard refresh

This projection groups the entire finding_repositories table by finding_id, but its existing primary-key index starts with repository_id; SQLite consequently scans the full table and builds a temporary grouping index. The count, page, and detail queries can repeat that work, and every open dashboard polls again every five seconds, so latency grows with the whole shared database rather than the visible page. Add an appropriate finding_id-leading index and restructure the projection so refreshes do not repeatedly materialize unrelated findings.

zcrab-oai · 2026-08-27T21:24:44Z

+  }
+  function filter(setter: (value: string) => void, value: string) {
+    setter(value);
+    setOffset(0);


[P2] Clear the selected finding when changing repository or query filters

filter() resets pagination but preserves selected, while the backend detail lookup retrieves the selected record solely by ID. Selecting a finding in repository A and then switching the filter to repository B therefore leaves A's details visible next to B's result list. Clear the selection whenever a filter changes, or require the detail query to satisfy the same active filters.

* feat: checkpoint dedupe reviews and replay group writes * fix: keep workflow source snapshots within the checkout * fix: migrate dedupe checkpoint bindings to SQLite columns * test: retain required canonical ID in translated checkpoint checks * test: align checkpoint contracts with the updated findings stack * feat(server): add read-only findings dashboard (#679) * feat(server): add read-only findings dashboard * fix(dashboard): show workflows first * refactor(dashboard): simplify rendering and reuse workflow storage * fix(dashboard): preserve filters and completed result semantics * fix(dashboard): retain published repository identities in search * fix(dashboard): include deep scan activity in freshness * refactor(dashboard): use native selects and remove dropdown machinery * refactor(dashboard): show only stored findings and groups --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com>

* feat: persist resumable local findings workflows * fix: store workflow metadata in explicit SQLite columns * test(plugin): align workflow helper and schema contracts * feat: checkpoint dedupe reviews and replay group writes (#674) * feat: checkpoint dedupe reviews and replay group writes * fix: keep workflow source snapshots within the checkout * fix: migrate dedupe checkpoint bindings to SQLite columns * test: retain required canonical ID in translated checkpoint checks * test: align checkpoint contracts with the updated findings stack * feat(server): add read-only findings dashboard (#679) * feat(server): add read-only findings dashboard * fix(dashboard): show workflows first * refactor(dashboard): simplify rendering and reuse workflow storage * fix(dashboard): preserve filters and completed result semantics * fix(dashboard): retain published repository identities in search * fix(dashboard): include deep scan activity in freshness * refactor(dashboard): use native selects and remove dropdown machinery * refactor(dashboard): show only stored findings and groups --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com>

* feat: publish custom findings and persist dedupe groups * refactor(test): translate write-back smoke assertions to TypeScript * test: align findings writeback with pair-only deduplication * test(plugin): include dedupe groups in schema expectations * test(plugin): update dedupe group migration snapshots * feat: persist resumable local findings workflows (#673) * feat: persist resumable local findings workflows * fix: store workflow metadata in explicit SQLite columns * test(plugin): align workflow helper and schema contracts * feat: checkpoint dedupe reviews and replay group writes (#674) * feat: checkpoint dedupe reviews and replay group writes * fix: keep workflow source snapshots within the checkout * fix: migrate dedupe checkpoint bindings to SQLite columns * test: retain required canonical ID in translated checkpoint checks * test: align checkpoint contracts with the updated findings stack * feat(server): add read-only findings dashboard (#679) * feat(server): add read-only findings dashboard * fix(dashboard): show workflows first * refactor(dashboard): simplify rendering and reuse workflow storage * fix(dashboard): preserve filters and completed result semantics * fix(dashboard): retain published repository identities in search * fix(dashboard): include deep scan activity in freshness * refactor(dashboard): use native selects and remove dropdown machinery * refactor(dashboard): show only stored findings and groups --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com>

* feat(typescript): deduplicate stored findings with Codex * refactor(typescript): group server deduplication modules * refactor(typescript): run scan deduplication in SDK and CLI * feat(typescript): scope finding retrieval by repository * refactor(typescript): trim redundant deduplication code * fix(typescript): restore complete deduplication reviews * refactor(typescript): trim deduplication setup and smoke bookkeeping * perf(typescript): reduce deduplication review work * test(plugin): include repository associations in schema expectations * test(plugin): update repository migration snapshots * test: read scan smoke manifest from canonical plugin source * feat: publish custom findings and persist dedupe groups (#667) * feat: publish custom findings and persist dedupe groups * refactor(test): translate write-back smoke assertions to TypeScript * test: align findings writeback with pair-only deduplication * test(plugin): include dedupe groups in schema expectations * test(plugin): update dedupe group migration snapshots * feat: persist resumable local findings workflows (#673) * feat: persist resumable local findings workflows * fix: store workflow metadata in explicit SQLite columns * test(plugin): align workflow helper and schema contracts * feat: checkpoint dedupe reviews and replay group writes (#674) * feat: checkpoint dedupe reviews and replay group writes * fix: keep workflow source snapshots within the checkout * fix: migrate dedupe checkpoint bindings to SQLite columns * test: retain required canonical ID in translated checkpoint checks * test: align checkpoint contracts with the updated findings stack * feat(server): add read-only findings dashboard (#679) * feat(server): add read-only findings dashboard * fix(dashboard): show workflows first * refactor(dashboard): simplify rendering and reuse workflow storage * fix(dashboard): preserve filters and completed result semantics * fix(dashboard): retain published repository identities in search * fix(dashboard): include deep scan activity in freshness * refactor(dashboard): use native selects and remove dropdown machinery * refactor(dashboard): show only stored findings and groups --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: Kyle Brown <272643392+kmbroai@users.noreply.github.com>

* feat(typescript): add findings service plumbing * feat(typescript): persist findings and embeddings through the service API * test(typescript): extract findings service Docker smoke runner * refactor(test): translate findings storage fixture to TypeScript * refactor(server): omit provisional bulk dedupe endpoint * docs: use canonical plugin source in findings import example * fix(plugin): support isolated findings helper execution * test(plugin): include findings storage in schema expectations * test(plugin): update findings migration snapshots * test: read findings smoke fixture from canonical plugin source * feat(typescript): deduplicate scans through SDK and CLI (#661) * feat(typescript): deduplicate stored findings with Codex * refactor(typescript): group server deduplication modules * refactor(typescript): run scan deduplication in SDK and CLI * feat(typescript): scope finding retrieval by repository * refactor(typescript): trim redundant deduplication code * fix(typescript): restore complete deduplication reviews * refactor(typescript): trim deduplication setup and smoke bookkeeping * perf(typescript): reduce deduplication review work * test(plugin): include repository associations in schema expectations * test(plugin): update repository migration snapshots * test: read scan smoke manifest from canonical plugin source * feat: publish custom findings and persist dedupe groups (#667) * feat: publish custom findings and persist dedupe groups * refactor(test): translate write-back smoke assertions to TypeScript * test: align findings writeback with pair-only deduplication * test(plugin): include dedupe groups in schema expectations * test(plugin): update dedupe group migration snapshots * feat: persist resumable local findings workflows (#673) * feat: persist resumable local findings workflows * fix: store workflow metadata in explicit SQLite columns * test(plugin): align workflow helper and schema contracts * feat: checkpoint dedupe reviews and replay group writes (#674) * feat: checkpoint dedupe reviews and replay group writes * fix: keep workflow source snapshots within the checkout * fix: migrate dedupe checkpoint bindings to SQLite columns * test: retain required canonical ID in translated checkpoint checks * test: align checkpoint contracts with the updated findings stack * feat(server): add read-only findings dashboard (#679) * feat(server): add read-only findings dashboard * fix(dashboard): show workflows first * refactor(dashboard): simplify rendering and reuse workflow storage * fix(dashboard): preserve filters and completed result semantics * fix(dashboard): retain published repository identities in search * fix(dashboard): include deep scan activity in freshness * refactor(dashboard): use native selects and remove dropdown machinery * refactor(dashboard): show only stored findings and groups --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: Kyle Brown <272643392+kmbroai@users.noreply.github.com> * feat(container): publish findings service and distribute workflow runner (#666) * feat(typescript): deduplicate stored findings with Codex * refactor(typescript): group server deduplication modules * refactor(typescript): run scan deduplication in SDK and CLI * feat(typescript): scope finding retrieval by repository * refactor(typescript): trim redundant deduplication code * fix(typescript): restore complete deduplication reviews * feat(container): publish findings service image to GHCR * feat: publish custom findings and persist dedupe groups * refactor(container): trim findings release verification * refactor(typescript): trim deduplication setup and smoke bookkeeping * feat(container): add scanner workflow runner Compose * refactor(test): translate write-back smoke assertions to TypeScript * refactor(test): translate runner smoke fixtures to TypeScript * perf(typescript): reduce deduplication review work * test: align findings writeback with pair-only deduplication * test(plugin): include repository associations in schema expectations * test(plugin): include dedupe groups in schema expectations * test(plugin): update repository migration snapshots * test(plugin): update dedupe group migration snapshots * test: read scan smoke manifest from canonical plugin source --------- Co-authored-by: Kyle Brown <272643392+kmbroai@users.noreply.github.com> --------- Co-authored-by: kmbroai <272643392+kmbroai@users.noreply.github.com>

kmbroai added 7 commits August 27, 2026 06:38

feat(server): add read-only findings dashboard

9db0aa8

fix(dashboard): show workflows first

06ad589

refactor(dashboard): simplify rendering and reuse workflow storage

9dd11b2

fix(dashboard): preserve filters and completed result semantics

b88ac31

fix(dashboard): retain published repository identities in search

31844ac

fix(dashboard): include deep scan activity in freshness

b5adf18

refactor(dashboard): use native selects and remove dropdown machinery

ffe2663

kmbroai added 4 commits August 27, 2026 09:46

refactor(dashboard): show only stored findings and groups

060cd37

Merge updated review checkpoints into findings dashboard

744c990

Merge branch 'dev/kyleb/findings-review-checkpoints' into dev/kyleb/f…

ab4d356

…indings-dashboard

fix(plugin): support isolated dashboard helper execution

692daa4

soyeon-oai approved these changes Aug 27, 2026

View reviewed changes

zcrab-oai reviewed Aug 27, 2026

View reviewed changes

kmbroai merged commit ab27774 into dev/kyleb/findings-review-checkpoints Aug 27, 2026
31 of 41 checks passed

kmbroai deleted the dev/kyleb/findings-dashboard branch August 27, 2026 21:39

Navigation Menu

Uh oh!

feat(server): add read-only findings dashboard - #679

feat(server): add read-only findings dashboard#679
kmbroai merged 11 commits into
dev/kyleb/findings-review-checkpointsfrom
dev/kyleb/findings-dashboard

kmbroai commented Aug 27, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

zcrab-oai left a comment

Uh oh!

zcrab-oai Aug 27, 2026

Uh oh!

zcrab-oai Aug 27, 2026

Uh oh!

zcrab-oai Aug 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

kmbroai commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Risk and rollout

Public disclosure review

Uh oh!

chatgpt-codex-connector Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

zcrab-oai left a comment

Choose a reason for hiding this comment

Uh oh!

zcrab-oai Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

zcrab-oai Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

zcrab-oai Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kmbroai commented Aug 27, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Aug 27, 2026 •

edited

Loading