CLI: failed structured history commands emit an ok: true envelope

[soyeon-oai]

Summary

A failed structured history command exits non-zero and reports an error on stderr, but still emits an ok: true envelope on stdout.

Reproduction

codex-security scans show 51e818d --format json --full-output

The seven-character scan ID prefix is invalid because prefixes must contain at least eight characters.

Actual behavior

Exit code:

2

stderr:

codex-security: Could not read Codex Security scan history: Scan ID prefixes must be at least eight characters.

stdout:

{
  "ok": true,
  "meta": {
    "command": "scans show",
    "duration": "97ms"
  }
}

Expected behavior

A failed command must not emit an ok: true structured response. It should emit either an ok: false error envelope or no structured stdout, consistently with the CLI error contract.

Impact

Automation that relies on structured stdout can incorrectly classify the failed command as successful.

Environment

• @openai/codex-security: 0.1.14
• Reproduced twice on PR fix: enforce typed finding detail contracts #439 head 34e687e5beda004dc9af585d8f375c5147187ffe
• Also reproduced on base 37bf87a692fc72d41f7312cc48808d699d204fba, so this is a pre-existing issue

[pasmud]

Fixed by #562: failed structured history commands now emit an ok: false error envelope instead of ok: true.