fix(cli): show progress while patching findings

[ianw-oai]

Summary

After the user approves findings for patching, the CLI can be silent until a patch task finishes. Show the current finding, elapsed time, and live Codex activity so the user can follow each patch.

Changes

• Reuse the existing activity parser and timer for scan follow-up patches and saved findings.
• Keep completed results in terminal history and send progress to stderr.
• Preserve plain progress for headless scans, JSON scans, CI, and redirected output. Stop the timer on completion, failure, or interruption.

Testing

Checks on the final commit:

• bun test --timeout 30000 tests-ts/cli-patch.test.ts tests-ts/cli-verify-fix.test.ts tests-ts/cli-skills.test.ts: 97 passed.
• pnpm run types: passed.
• pnpm run build:ci: passed.
• pnpm exec prettier --check src/cli.ts tests-ts/cli-patch.test.ts README.md: passed.
• git diff --check origin/main...HEAD: passed.

An earlier full run before the rebase had 2,993 passes, 59 skips, and 4 failures. Three failures reproduced on the unchanged base in Git metadata and publication tests. The fourth was the headless progress case, which passes in the final focused run. The full suite was not rerun after the rebase.

Risk and rollout

Low risk. This changes terminal progress and uses existing Codex events. Existing flags control terminal behavior. Progress display failures do not stop patching.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-15T21:08:31.033757Z	eca7333	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cstolting-collab]

I rebased and locally verified this change against current main at 02c5137fbe807a83c370bed05dc2a8d06f113d79.

The only merge conflict was in sdk/typescript/tests-ts/cli-patch.test.ts; I retained both the current-main test additions and this PR's progress tests. The resulting candidate changes the same three files and preserves the intended behavior.

Verification on the rebased candidate:

• the three new progress regressions fail on the baseline and pass on the candidate;
• bun test --timeout 30000 --seed 12345 tests-ts/cli-patch.test.ts tests-ts/cli-verify-fix.test.ts tests-ts/cli-skills.test.ts: 111 passed, 0 failed;
• pnpm run types, pnpm run build:ci, and changed-file Prettier checks passed;
• Git whitespace and post-test tracked-file checks passed.

The focused suite was run; the full upstream suite and live cloud-agent execution were not run. No upstream branch, push, PR update, or merge was performed by this verification.

[cstolting-collab]

I opened #950 with this PR rebased onto current main and the cli-patch.test.ts conflict resolved. It preserves the original implementation and tests; the new PR includes the focused local validation results.