scans match --all builds unbounded quadratic history payloads

Summary

Automatic scan-history matching sends all findings from every earlier unmatched scan in one model request for each later scan.

Relevant code:

• matching-plan materialization
• flattening every previous scan
• single comparison prompt
• unbounded input serialization

For scan n, the batch includes findings from scans 1..n-1. Across a history, materialized and submitted data therefore grows approximately quadratically. There is no finding-count or prompt-byte limit.

The matching plan is first returned through runWorkbench, which has a 4 MiB stdout limit, so a large history can fail locally before comparison begins. Smaller payloads can still exceed model context or cause unexpectedly high matching cost.

Why this matters

The feature becomes less reliable and more expensive as the repository accumulates the history it is designed to compare. One finding-heavy scan can make every later batch substantially larger.

Expected behavior

Matching should operate within documented, deterministic input limits and remain usable for long-lived repositories.

Suggested direction

Process bounded finding batches, persist intermediate pair results, and reconcile cross-batch groups deterministically. If safe batching cannot preserve semantics, enforce an explicit history/finding ceiling with guidance to match smaller ranges.

Add scale tests that verify prompt/workbench payload limits and stable behavior across multiple batches.

Found by static audit of upstream main at 9c7634b.

Trace matching-plan materialization in sdk/typescript/_bundled_plugin/scripts/workbench_scan_history.py, then follow flattening in sdk/typescript/src/cli.ts and prompt serialization in sdk/typescript/src/scan-comparison.ts. Add scale tests covering workbench and prompt limits and stable behavior across multiple batches; done means long histories remain within documented deterministic limits.