[mldangelo-oai]

Summary

A short rate limit on a late page should not force an entire hosted scanner collection to restart.

Changes

• Retry the identical read-only Snyk REST or Semgrep Platform GET once when HTTP 429 includes a valid Retry-After at most 10 seconds away. Support integer seconds and HTTP dates, including a past date.
• Release the throttled body and honor cancellation while waiting. Do not retry permission failures, malformed payloads, POSTs, unsafe redirect targets or unusable/long waits. Preserve the final upstream error and never return a partial report.

Testing

The recorded suite counts below are historical results from before this rebase; they do not attest to the current head.

Current head

• Merged the current hosted parent, including its Snyk Issues API-version correction. The focused child changes remain unchanged; git diff --check passed. Fresh CI and automated review run on this updated head.
• Fresh pinned dependency installation could not complete because of service connectivity. Scoped and full suites, type/format checks, plugin checks and package smoke tests have not been rerun on this head.
• Native prepublication review remains incomplete because its service-readiness check timed out. GitHub CI and automated review are pending.
• No live vendor tenant or deployed Cloud service was tested.

Historical validation before rebase

56 focused tests passed across both collectors, the CLI and shared transport on the original tested tree. Covered missing, invalid, elapsed, excessive and repeated limits, cancellation, stable page query and credentials, and a recovered late page. No live Snyk or Semgrep tenant was contacted.

Risk and rollout

Depends on the hosted scanner collection parent PR; this PR targets dev/codex/hosted-scanner-findings.

Base branch: dev/codex/hosted-scanner-findings (the hosted collection parent).

Requires the hosted collection parent. At most one additional GET and ten seconds of waiting per eligible page; no new flags, storage, API keys, or fallback hosts.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T17:12:56.970941Z	7ce6646	New commits
🔒 Security Review	✅ Completed 2026-10-27T17:14:18.322904Z	7ce6646	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for keeping retries bounded and preserving the original request scope. This owner-level merge-safety review found no material issues: only an eligible read is retried, cancellation stops the wait, and a persistent failure still prevents partial output.

Validation: 54 focused HTTP, collector and CLI tests passed, including all three HTTP-date formats, exact delay boundaries, cancellation, repeated throttling and late-page recovery. Types and formatting passed. Two unchanged persistence cases were filtered because of the established environment limitation; no live vendor tenant was contacted.