Summary
The scan progress parser can treat marker text inside Markdown code fences as live progress/status.
There are two related parser gaps in sdk/typescript/src/worker-progress.ts.
Progress markers
scanProgressUpdatesFromEvent() tracks fences with a single boolean and flips it for every line beginning with backticks:
let codeFence = false;
for (const line of output.split(/\r?\n/u)) {
if (/^\s*```/u.test(line)) {
codeFence = !codeFence;
continue;
}
...
}Markdown fences may use more than three backticks. In this valid shape:
````markdown
```text
CODEX_SECURITY_SCAN_PROGRESS {"phase":"discovery","filesCompleted":8,"filesTotal":8}
```
an inner three-backtick line does not close the outer four-backtick fence, but the boolean parser toggles to `false`. The marker that follows is therefore emitted as live progress even though it is still quoted code.
### Worker-status markers
`dispatchStatus()` filters every agent-message line beginning with `CODEX_SECURITY_WORKER_STATUS` and does not perform any fence tracking. A documented/example marker in an ordinary fenced block can therefore be emitted as a real dispatch update.
## Expected behavior
Only markers outside Markdown fenced code blocks should affect scan progress or worker status. A closing fence should use the same marker character and at least the opening fence length; shorter nested-looking fences must remain content.
## Impact
Quoted workflow documentation, source excerpts, or model explanations can produce false phase/file counts or worker dispatch state in observers and progress UI.
## Suggested fix
Share a small fenced-line filter between progress and dispatch parsing. Track the opening backtick/tilde character and run length rather than toggling a boolean, and add regressions for a four-backtick outer fence plus ordinary fenced worker-status examples.
Summary
The scan progress parser can treat marker text inside Markdown code fences as live progress/status.
There are two related parser gaps in
sdk/typescript/src/worker-progress.ts.Progress markers
scanProgressUpdatesFromEvent()tracks fences with a single boolean and flips it for every line beginning with backticks:Markdown fences may use more than three backticks. In this valid shape: