Summary
Automatic scan-history matching sends all findings from every earlier unmatched scan in one model request for each later scan.
Relevant code:
For scan n, the batch includes findings from scans 1..n-1. Across a history, materialized and submitted data therefore grows approximately quadratically. There is no finding-count or prompt-byte limit.
The matching plan is first returned through runWorkbench, which has a 4 MiB stdout limit, so a large history can fail locally before comparison begins. Smaller payloads can still exceed model context or cause unexpectedly high matching cost.
Why this matters
The feature becomes less reliable and more expensive as the repository accumulates the history it is designed to compare. One finding-heavy scan can make every later batch substantially larger.
Expected behavior
Matching should operate within documented, deterministic input limits and remain usable for long-lived repositories.
Suggested direction
Process bounded finding batches, persist intermediate pair results, and reconcile cross-batch groups deterministically. If safe batching cannot preserve semantics, enforce an explicit history/finding ceiling with guidance to match smaller ranges.
Add scale tests that verify prompt/workbench payload limits and stable behavior across multiple batches.
Found by static audit of upstream main at 9c7634b.
Summary
Automatic scan-history matching sends all findings from every earlier unmatched scan in one model request for each later scan.
Relevant code:
For scan
n, the batch includes findings from scans1..n-1. Across a history, materialized and submitted data therefore grows approximately quadratically. There is no finding-count or prompt-byte limit.The matching plan is first returned through
runWorkbench, which has a 4 MiB stdout limit, so a large history can fail locally before comparison begins. Smaller payloads can still exceed model context or cause unexpectedly high matching cost.Why this matters
The feature becomes less reliable and more expensive as the repository accumulates the history it is designed to compare. One finding-heavy scan can make every later batch substantially larger.
Expected behavior
Matching should operate within documented, deterministic input limits and remain usable for long-lived repositories.
Suggested direction
Process bounded finding batches, persist intermediate pair results, and reconcile cross-batch groups deterministically. If safe batching cannot preserve semantics, enforce an explicit history/finding ceiling with guidance to match smaller ranges.
Add scale tests that verify prompt/workbench payload limits and stable behavior across multiple batches.
Found by static audit of upstream
mainat9c7634b.