[John-David Dalton (jdalton)]

LLM Description written by Codex:gpt-6-astra

Keep full-scan reads working while analysis is still processing. Existing callers now use cached results with bounded polling instead of holding one long request.

Root Cause

fullscans.stream() made one uncached request and treated 202 Processing as a failed result.

Fix

• Poll cached results within the caller's configured timeout.
• Retry processing responses and existing transient errors; preserve authorization and not-found failures.
• Keep dictionary and typed artifact parsing unchanged.

Validation

29 tests pass against a local HTTP fixture using the real SDK and requests transport. Ruff and diff checks pass. Tests cover processing, timeout, transient and permanent failures, encoded identifiers, invalid settings, and artifact parsing.

Ships in the unreleased 3.6.2 alongside #113; the changelog entry is under 3.6.2. No CLI dependency update is included.

Public Changelog

Full-scan reads wait for cached analysis results within the configured timeout.

---

Note

Medium Risk
Default fullscans.stream() behavior changes (cached URL, polling, and timeout semantics), which may affect integrations that relied on immediate failure on 202 or uncached reads.

Overview
fullscans.stream() no longer treats a single 202 Processing as failure. It hits the cached stream endpoint (?cached=true), retries while analysis runs, and returns parsed artifacts once the API responds with 200.

Polling uses a total budget (default: SDK timeout) with backoff from 5s to 10s, optional poll_* keyword args, and per-request timeouts capped by remaining budget. APITimeout is raised when results are not ready in time; auth, not-found, and quota errors still fail immediately. Transient APIFailure cases retry within the same budget.

API.do_request() gains keyword-only request_timeout for one-off limits. Org slug and scan id path segments are URL-encoded. Responses are **close()**d during polling and error paths.

Docs/changelog for 3.6.2 and a localhost SocketApiFixture plus HTTP tests cover processing, retries, timeouts, validation, and encoding.

^{Reviewed by Cursor Bugbot for commit 5a7e742. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5a7e742. Configure here.}