[cli] Publish multiple scans to Cloud

[kmbroai]

Summary

Publishes several saved scans in one command, using scan IDs or an interactive picker. The CLI looks up the artifact directories so users do not need to find them. Depends on #612.

codex-security publish scan --to cloud \
  --scan SCAN_ID_A --scan SCAN_ID_B --dry-run --json

Omit --scan to choose completed scans interactively. Select scans, then choose Done. Remove --dry-run to publish.

Changes

• Reuse saved history for --scan IDs, unique prefixes, and latest. Resolve all requested IDs before uploading and publish each selected scan once.
• Reuse the existing picker pattern for multiple Cloud selections. Nothing is selected automatically, and canceling selection uploads nothing.
• Require completed scans with available artifacts. Check that the sealed artifact ID matches the selected saved scan before publication.
• Keep repeated --scan-dir and the single positional directory for external artifacts, using resolveCliPath. Reject mixed ID and directory inputs. Linear accepts one scan, including --scan.
• Upload one scan per request. Keep each acceptance receipt with its scan result.
• Continue after per-scan errors. On cancellation, return received receipts and list the scans that were not attempted.

Testing

• Focused Cloud and Linear publication tests: 97 passed.
• Full test suite (seed 12345 and randomized), with umask 022: 1,568 passed, 27 skipped, 0 failed in each run.
• pnpm run types, pnpm run format, and pnpm run build: passed.
• Built CLI test with two synthetic scans in a real local history database: ID/prefix deduplication, latest, and directory previews passed. A localhost mock server returned two accepted receipts. Nothing was uploaded to Cloud.

Risk and rollout

No server changes are needed. Each request uses the existing format. Saved scan selection still requires local artifacts; history alone is not enough to publish.

Some scans can succeed even if others fail. The CLI never retries requests automatically. A missing or invalid receipt does not prove an upload failed; check whether Cloud accepted the scan before resubmitting it.

Receipts are returned in command output and are not saved to publication history. Selecting an entire bulk-scan run is not part of this PR.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-24T17:12:18.273958Z	a3a48ae	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.