Skip to content

scans match --all builds unbounded quadratic history payloads #136

Description

@GautamSharma99

Summary

Automatic scan-history matching sends all findings from every earlier unmatched scan in one model request for each later scan.

Relevant code:

For scan n, the batch includes findings from scans 1..n-1. Across a history, materialized and submitted data therefore grows approximately quadratically. There is no finding-count or prompt-byte limit.

The matching plan is first returned through runWorkbench, which has a 4 MiB stdout limit, so a large history can fail locally before comparison begins. Smaller payloads can still exceed model context or cause unexpectedly high matching cost.

Why this matters

The feature becomes less reliable and more expensive as the repository accumulates the history it is designed to compare. One finding-heavy scan can make every later batch substantially larger.

Expected behavior

Matching should operate within documented, deterministic input limits and remain usable for long-lived repositories.

Suggested direction

Process bounded finding batches, persist intermediate pair results, and reconcile cross-batch groups deterministically. If safe batching cannot preserve semantics, enforce an explicit history/finding ceiling with guidance to match smaller ranges.

Add scale tests that verify prompt/workbench payload limits and stable behavior across multiple batches.

Found by static audit of upstream main at 9c7634b.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions