fix(cli): emit ok:false envelope for failed history commands

sdk/typescript/src/cli.ts

@@ -1216,13 +1216,13 @@ export async function main(
     args: readonly string[],
     select: (value: JsonObject) => JsonObject | Promise<JsonObject> = (value) =>
       value,
-  ): Promise<JsonObject | undefined> => {
+  ): Promise<JsonObject> => {
     try {
       return await select(await dependencies.runWorkbench(args));
     } catch (error) {
       errorOutput.write(`codex-security: ${errorMessage(error)}\n`);
       exitCode = 2;
-      return undefined;
+      throw error;
     }
   };
   const latestScans = async (
@@ -1613,7 +1613,7 @@ export async function main(
         } catch (error) {
           errorOutput.write(`codex-security: ${errorMessage(error)}\n`);
           exitCode = 2;
-          return undefined;
+          throw error;
         }
       },
     })

sdk/typescript/tests-ts/cli.test.ts

@@ -1220,6 +1220,32 @@ describe("CLI", () => {
     );
   });
 
+  test("does not emit an ok: true envelope for a failed structured history command", async () => {
+    for (const argv of [
+      ["scans", "show", "--json"],
+      ["scans", "list", "--json"],
+      ["scans", "compare", "before", "after", "--json"],
+      ["scans", "match", "before", "after", "--json"],
+    ]) {
+      const stdout = capture();
+      const stderr = capture();
+      const result = await main(argv, stdout.stream, stderr.stream, {
+        ...dependencies({
+          onWorkbench: () => {
+            throw new Error(
+              "Scan ID prefixes must be at least eight characters.",
+            );
+          },
+        }),
+      });
+      expect(result).toBe(2);
+      expect(stdout.text()).toBe("");
+      expect(stderr.text()).toContain(
+        "Scan ID prefixes must be at least eight characters.",
+      );
+    }
+  });
+
   test("shows finding history and optionally reveals linked findings", async () => {
     const findings: JsonObject[] = [
       {