fix: advance scan progress when saving drafts

[ianw-oai]

Summary

A Standard scan can save valid review results while its displayed phase stays at the initial step. Saving a draft did not update progress, so the display depended on separate progress calls from the scan task.

This change advances the phase when a valid draft is saved. A partial checkpoint advances the scan to at least discovery. A final draft advances it to reporting. The scan remains running until normal completion succeeds.

Changes

• Update progress only after the draft passes validation and its files are saved.
• Preserve later phases and their counts when a late checkpoint arrives. Reset phase counts only when the phase advances.
• Keep draft saving successful if the optional progress update fails.
• Make phase updates explicit in the desktop scan instructions.
• Extend the existing MCP integration test for source and bundled servers.

Testing

The same controlled scan ran against the original and patched packaged MCP server, with no explicit progress calls. The original stayed in preflight after both a partial checkpoint and a final draft. The patch advanced to discovery and reporting while the scan was still running. Both runs completed. The regression test failed on the original code and passed with the patch.

Passed:

• All 23 MCP test files, including the source and bundled draft integration test.
• MCP TypeScript typecheck.
• Ruff lint and format checks for the full plugin with Ruff 0.16.1.
• pnpm --dir sdk/typescript run build:ci.
• node .github/scripts/check_plugin_source_compatibility.mjs.
• node --test .github/scripts/test_check_plugin_source_compatibility.mjs (9 tests).
• git diff --check.

Native desktop verification did not reach app launch. A Python CLI-help test failed to import a sibling module with Python safe-path mode enabled. The unchanged original helper reproduced the same failure. The full Python suite was stopped after that failure. No native UI or full model-driven scan is claimed as verified.

Risk and rollout

The change applies to Standard scans. It does not change public commands, flags, schemas, or completion checks. Deep and diff scans retain their current behavior. Install the updated plugin to use the fix; an existing scan advances when it saves its next accepted checkpoint or receives an explicit progress update.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-11T17:03:13.223300Z	0a72e96	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.