feat(cli): allow interactive scan budget increases - #724

Summary

Interactive scans currently stop when their estimated cost exceeds --max-cost, even when the user would approve more spending. This change offers a higher total limit at 80% of the current budget, while the scan is still running. The original limit remains active until the increase is saved, and continuing preserves the scan ID, completed work, and accumulated cost.

The change also fixes accounting needed for reliable budget decisions: a parent receipt can be lost when only worker logs are available, and a cost-limit error can omit usage recorded while the scan is stopping.

Changes

• Reuse the dashboard input loop to accept a higher total USD limit. Blank Enter or Escape keeps the old limit; Ctrl-C or Ctrl-D cancels. CI, JSON/JSONL, headless, verbose, and non-TTY scans keep their existing budget behavior.
• Add the optional SDK onBudgetApproaching({ maxCostUsd, cost, signal }) callback and report the effective limit through onCost(cost, maxCostUsd). Decisions do not block tracking; invalid, failed, or late increases leave the old limit enforced.
• Persist approved increases in the existing scan recipe without replacing other settings. Reuse the same scan, output, and cumulative usage; time and discovery limits do not change.
• Reconcile parent and validation receipts with cumulative session logs once per thread, preserve unknown usage, and include later measured spending in cost-limit errors.
• Update help and documentation. No new public CLI flag or dependency is introduced.
• Set up Python 3.12 before Windows test shards and preserve the runner's temporary directories in workflow-resume fixtures. Apply the Python formatting checks added on main.

Testing

• Initial full TypeScript suite on macOS: 2,085 passed, 36 skipped, 0 failures (--seed=12345).
• CI follow-up: API and release-workflow suites passed with the failing CI seed (3825532106): 426 passed, 2 skipped. Typecheck, formatting, Ruff 0.16.1 lint and format checks, portable source checks, and package installation checks passed.
• Python workbench suite: 108 passed.
• MCP test suite, plugin source boundary check, build, typecheck, formatting, and git diff --check: passed.
• Packed npm archive validation and clean installation smoke tests passed, including public imports, NodeNext types, CLI startup, credential locking, MCP initialization, and a nested worker without a global Codex installation.
• Nine terminal scenarios passed against the built Node CLI: standard and deep scan increases, invalid input followed by correction in a 60-column terminal, blank input, Escape, an ignored prompt, Ctrl-C, headless mode, and JSON output. Checked that approved increases keep the same scan and accumulated cost, declined or ignored increases retain the old cap, and the dashboard restores terminal input.

Terminal QA used synthetic model usage. No billable model calls were made; platform-specific and opt-in integration tests remain subject to their normal skip conditions.

Risk and rollout

The existing --max-cost option now offers increases only in the interactive scan dashboard. SDK callers opt in through the new callback; callers without it retain automatic stopping. Only finite totals above the current limit and latest estimate are accepted, and cancellation takes precedence over a late answer.

This does not pause model work or resume a scan after exhaustion. The old limit can still stop the scan while the user decides, and sampled estimates can overshoot the cap. Post-scan prompts remain outside scan cost tracking, as documented. Bulk and component budget interactions are unchanged. No database migration is needed.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.