fix(cli): report component scan progress headlessly

[Hughhhhcoder]

Summary

Headless and CI runs of scan-components now report per-component progress and estimated cost. Previously, those runs only printed component lifecycle transitions because scan observers were registered only when the interactive dashboard was active.

Fixes #803

Changes

• Register a scan-event presenter when the interactive dashboard is unavailable.
• Use component names and existing formatting helpers to display scan phases, file counts, token usage, and estimated cost.
• Emit progress and cost events to stderr; suppress activity text and raw session events.
• Cover dashboard, headless, and CI presentation in the component-scan tests.

Testing

Independent validation of commit a33bbcf000c70d367a2a89cabba4d58b3dc4b9cd:

• Five focused Bun tests passed: dashboard, headless, and CI presentation; component event forwarding and observer failures; dashboard cleanup on cancellation.
• tsc --noEmit passed.
• Prettier checks passed for both changed files.
• git diff --check passed.

The focused local tests use synthetic repositories and mocked scans.

Risk and rollout

This adds progress and cost lines to headless stderr output, making long-running component scans easier to monitor. JSON results remain on stdout. The interactive dashboard continues to receive the existing scan events. No new command, flag, environment variable, or dependency is introduced. Suitable for a normal patch release.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[Hughhhhcoder]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T02:56:05.199563Z	a33bbcf	Manual request
🔒 Security Review	✅ Completed 2026-09-04T02:56:48.811564Z	a33bbcf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: a33bbcf000

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

Thanks for tracking this down and keeping the fix focused. Forwarding the existing progress and cost events makes long-running component scans much easier to follow in CI, and the tests cover headless and CI output alongside the existing dashboard behavior. Required CI checks and the focused local tests and TypeScript/format checks pass. Looks good!

One CI limitation: npm's advisory endpoint timed out during the optional dependency audit. This PR leaves dependency files unchanged.