fix(findings): honor saved decisions during fallback matching

.devcontainer/devcontainer-lock.json

@@ -1,14 +1,14 @@
 {
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:4": {
-      "version": "4.1.0",
-      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7",
-      "integrity": "sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7"
+      "version": "4.1.2",
+      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:ad3d6d36d95ee7f880f61f98862257f3e70253d3faef09f86af42fb87ee60429",
+      "integrity": "sha256:ad3d6d36d95ee7f880f61f98862257f3e70253d3faef09f86af42fb87ee60429"
     },
     "ghcr.io/devcontainers/features/github-cli:1": {
-      "version": "1.1.2",
-      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805",
-      "integrity": "sha256:7c409bf6316ffd85f04fd92fba85a744282639e603417dd4796409866bdb6805"
+      "version": "1.1.3",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:bd7ab48a832228f633239277552c30b353867fef2e5b037e064b4e64f0b843f2",
+      "integrity": "sha256:bd7ab48a832228f633239277552c30b353867fef2e5b037e064b4e64f0b843f2"
     },
     "ghcr.io/devcontainers/features/node:2": {
       "version": "2.1.0",

.gitattributes

@@ -10,3 +10,6 @@
 *.tsx text eol=lf
 *.yaml text eol=lf
 *.yml text eol=lf
+
+# Bundled dependencies contain intentional whitespace in strings and comments.
+github-action/dist/*.cjs linguist-generated=true -whitespace

.github/actionlint.yaml

@@ -0,0 +1,11 @@
+paths:
+  .github/workflows/{node-github-release,node-release-cut,node-release}.yml:
+    ignore:
+      # actionlint 1.7.12 predates GitHub's queue: max support. Keep release queuing.
+      # https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency
+      - '^unexpected key "queue" for "concurrency" section\.'
+  .github/workflows/invoice-desk-scan.yml:
+    ignore:
+      # actionlint 1.7.12 predates GitHub's job-level cache permissions.
+      # https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcache-mode
+      - '^unexpected key "cache-mode" for "job" section\.'

.github/actions/check-action-candidate/action.yml

@@ -0,0 +1,27 @@
+name: Check Action against release candidate
+description: Exercise the Action adapter against the packed CLI without model calls.
+runs:
+  using: composite
+  steps:
+    - name: Set up Action Node.js runtime
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: "24"
+        package-manager-cache: false
+    - name: Set up the Ubuntu sandbox
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install --yes bubblewrap apparmor-profiles
+        sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict
+    - name: Test Action compatibility with the packed CLI
+      shell: bash
+      run: |
+        set -euo pipefail
+        npm --prefix github-action ci --ignore-scripts --no-audit --no-fund
+        consumer="$(mktemp -d)"
+        trap 'rm -rf "$consumer"' EXIT
+        printf '%s\n' '{"name":"action-candidate-check","private":true,"type":"module"}' > "$consumer/package.json"
+        npm install --prefix "$consumer" --ignore-scripts --include=optional --no-audit --no-fund ./dist/*.tgz
+        version="$(node -p 'require("./sdk/typescript/package.json").version')"
+        npm --prefix github-action run test:cli -- "$consumer/node_modules/@openai/codex-security" "$version"

.github/actions/setup-tools/action.yml

@@ -0,0 +1,36 @@
+name: Set up TypeScript tools
+description: Install the pinned package manager and Node.js runtime for repository tools.
+inputs:
+  setup-node:
+    description: Install the pinned Node.js runtime; false keeps an earlier setup step.
+    default: "true"
+  cache-dependency-path:
+    description: Lockfiles used for the pnpm store cache.
+    default: "sdk/typescript/pnpm-lock.yaml"
+  architecture:
+    description: Node.js architecture; empty selects the runner architecture.
+  compile:
+    description: Compile TypeScript tools after setup.
+runs:
+  using: composite
+  steps:
+    - name: Set up pnpm
+      uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      with:
+        package_json_file: package.json
+    # setup-node saves its cache only after a successful job.
+    - name: Set up Node.js and pnpm cache
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: ${{ inputs.setup-node == 'true' && '22.13.0' || '' }}
+        architecture: ${{ inputs.architecture }}
+        cache: pnpm
+        cache-dependency-path: ${{ inputs.cache-dependency-path }}
+    - name: Compile TypeScript tools
+      if: inputs.compile == 'true'
+      shell: ${{ runner.os == 'Windows' && 'pwsh' || 'bash' }}
+      working-directory: .
+      run: |
+        pnpm --dir sdk/typescript install --frozen-lockfile
+        ${{ runner.os == 'Windows' && 'if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }' || '' }}
+        pnpm --dir sdk/typescript run build:ci

.github/dependabot.yml

@@ -1,10 +1,12 @@
 version: 2
 updates:
   - package-ecosystem: npm
+    labels: [dependencies]
     directories:
+      - /github-action
       - /sdk/typescript
       - /plugins/codex-security/mcp-app
-      - /plugins/codex-security/skills/triage-finding/evals
+      - /evals/triage-finding
     schedule:
       interval: cron
       cronjob: "0 9 * * *"
@@ -38,6 +40,7 @@ updates:
       include: scope
 
   - package-ecosystem: pip
+    labels: [dependencies]
     directory: /plugins/codex-security
     schedule:
       interval: cron
@@ -51,6 +54,7 @@ updates:
       include: scope
 
   - package-ecosystem: github-actions
+    labels: [dependencies]
     directory: /
     schedule:
       interval: cron
@@ -61,3 +65,39 @@ updates:
         - "openai/*"
     commit-message:
       prefix: ci
+
+  - package-ecosystem: docker
+    labels: [dependencies]
+    directory: /
+    schedule:
+      interval: cron
+      cronjob: "0 9 * * *"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: cargo
+    labels: [dependencies]
+    directory: /plugins/codex-security/native
+    schedule:
+      interval: cron
+      cronjob: "0 9 * * *"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: devcontainers
+    labels: [dependencies]
+    directory: /
+    schedule:
+      interval: cron
+      cronjob: "0 9 * * *"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore
+      include: scope

.github/release-notes.md

@@ -1,41 +1,74 @@
-<!-- release-version: 0.1.27 -->
+<!-- release-version: 0.2.0 -->
 
 <!-- release-section: highlights:start -->
+
 ## Highlights
 
-- port source and test report checks to TypeScript ([#768](https://github.com/openai/codex-security/pull/768))
-- port custom validation to TypeScript ([#792](https://github.com/openai/codex-security/pull/792))
-- add Python-free Unix OS primitives ([#794](https://github.com/openai/codex-security/pull/794))
-- add Python-free Windows OS primitives ([#795](https://github.com/openai/codex-security/pull/795))
-- add Python-free musl native artifacts ([#796](https://github.com/openai/codex-security/pull/796))
-- bundle verified native runtime artifacts ([#797](https://github.com/openai/codex-security/pull/797))
-- preserve Windows filenames in native helpers ([#798](https://github.com/openai/codex-security/pull/798))
-- port security policy resolution to TypeScript ([#799](https://github.com/openai/codex-security/pull/799))
-- budget package installation and verification ([#834](https://github.com/openai/codex-security/pull/834))
-- open ready pull requests ([#833](https://github.com/openai/codex-security/pull/833))
-- draft SECURITY.md for owner review ([#536](https://github.com/openai/codex-security/pull/536))
-- resolve Windows Node to an absolute executable ([#788](https://github.com/openai/codex-security/pull/788))
-- shard automatic component planning for large repositories ([#845](https://github.com/openai/codex-security/pull/845))
-- import CSV and JSON findings as saved scans ([#850](https://github.com/openai/codex-security/pull/850))
-- add a feedback command ([#854](https://github.com/openai/codex-security/pull/854))
-- improve scan usage and cost reports ([#853](https://github.com/openai/codex-security/pull/853))
-- recover interrupted Deep Scans and bulk campaigns ([#835](https://github.com/openai/codex-security/pull/835))
-- reject owned plugin keys inside Codex profiles ([#861](https://github.com/openai/codex-security/pull/861))
-- include CommonJS and TypeScript module extensions in scan inventories ([#859](https://github.com/openai/codex-security/pull/859))
-- include workflow files in diff inventories ([#820](https://github.com/openai/codex-security/pull/820))
-- accept a UTF-8 byte order mark in imported findings JSON ([#856](https://github.com/openai/codex-security/pull/856))
-- authenticate deep workers with OpenAI API keys ([#870](https://github.com/openai/codex-security/pull/870))
-- drop canonical document size limits that do not exist ([#868](https://github.com/openai/codex-security/pull/868))
-- pin native Rust formatting edition ([#863](https://github.com/openai/codex-security/pull/863))
-- detect a Linear URL contradiction over plain HTTP ([#867](https://github.com/openai/codex-security/pull/867))
-- pipeline dedupe with configurable concurrency ([#852](https://github.com/openai/codex-security/pull/852))
-- disable reasoning summaries by default for Bedrock ([#869](https://github.com/openai/codex-security/pull/869))
-- reuse scan authentication for patch and validation ([#871](https://github.com/openai/codex-security/pull/871))
-- bump smol-toml from 1.6.1 to 1.7.1 in /sdk/typescript ([#873](https://github.com/openai/codex-security/pull/873))
+- Threat models are now saved with Standard, Deep, and Diff scan results and
+  generated security policies. Export a saved model without another model call
+  using `codex-security export --artifact threat-model` or the SDK's
+  `exportArtifact` helper.
+  ([#1133](https://github.com/openai/codex-security/pull/1133))
+- Scans now check for exposed credentials in source code, including unused code
+  and tests, and distinguish suspected exposures from placeholders. This check
+  runs offline, without trying discovered credentials against a service.
+  ([#1134](https://github.com/openai/codex-security/pull/1134))
+- Use `--model` and `--effort` when generating patches, validating findings,
+  verifying fixes, or matching and comparing saved scans. Deep Scan workers and
+  patches generated during a scan also respect your selected service tier.
+  ([#1143](https://github.com/openai/codex-security/pull/1143),
+  [#1238](https://github.com/openai/codex-security/pull/1238),
+  [#1274](https://github.com/openai/codex-security/pull/1274))
+- Patch, validation, and fix-verification commands now respect custom model
+  providers and their authentication settings. Amazon Bedrock users get clearer
+  authentication errors and cost estimates for Daybreak Blue and Red. Eligible
+  OpenAI API-key users can select a Cyber access program for each scan.
+  ([#1131](https://github.com/openai/codex-security/pull/1131),
+  [#1187](https://github.com/openai/codex-security/pull/1187),
+  [#1188](https://github.com/openai/codex-security/pull/1188),
+  [#1185](https://github.com/openai/codex-security/pull/1185))
+- Scans include previously overlooked C++ headers (`.hh` and `.hxx`),
+  server-rendered templates (EJS, ERB, and PHTML), and Vyper source files when
+  selecting code to review.
+  ([#1079](https://github.com/openai/codex-security/pull/1079),
+  [#1197](https://github.com/openai/codex-security/pull/1197),
+  [#1306](https://github.com/openai/codex-security/pull/1306))
+- On Unix, scans check that the sandbox works before starting paid model calls.
+  Completed results are kept if you cancel follow-up work. CSV exports can now be
+  reimported without rejecting multiple occurrences of a finding or losing
+  leading apostrophes.
+  ([#1084](https://github.com/openai/codex-security/pull/1084),
+  [#1057](https://github.com/openai/codex-security/pull/1057),
+  [#1247](https://github.com/openai/codex-security/pull/1247))
+
 <!-- release-section: highlights:end -->
 
 <!-- release-section: upgrades:start -->
+
 ## Upgrade notes
 
-Review compatibility and document any required migration steps before releasing.
+- If your integration reads threat models, check `SecurityPolicyDraft.threatModelPath`
+  for `null` before opening the file. Policy generation now writes `threatmodel.md`
+  instead of `THREAT_MODEL.md`; use the returned path. Saved models can contain
+  Markdown (`format: "markdown"`, `content`) or the previous structured format, so
+  readers must handle both. Existing models remain readable and exportable
+  without migration.
+  ([#1133](https://github.com/openai/codex-security/pull/1133))
+- Findings service clients must send `Content-Type: application/json` to
+  `POST /v1/bulk/findings` and `POST /v1/dedupe-groups`. Missing or other content
+  types return HTTP 400 `invalid_request`. A charset parameter is accepted.
+  ([#1277](https://github.com/openai/codex-security/pull/1277))
+- Codex Security no longer masks diagnostic text that looks like credentials.
+  CLI output and saved error, publication, and patch-risk summaries can contain
+  sensitive values. Review them before sharing.
+  ([#1179](https://github.com/openai/codex-security/pull/1179))
+- SDK types and CLI schemas now accept any nonempty string for reasoning effort.
+  Update integrations that assume a fixed list. The chosen value must still be
+  supported by Codex and your model provider.
+  ([#1237](https://github.com/openai/codex-security/pull/1237))
+- Older CSV exports may have ambiguous leading apostrophes that cannot be
+  recovered from the CSV alone. Export the original saved results as JSON if you
+  need those exact values.
+  ([#1247](https://github.com/openai/codex-security/pull/1247))
+
 <!-- release-section: upgrades:end -->

.github/release-pr-state.json

@@ -1,14 +1,14 @@
 {
-  "baseVersion": "0.1.26",
-  "baseCommit": "2536d104deef9bca8ced84c6f6263b915418253b",
+  "baseVersion": "0.1.32",
+  "baseCommit": "7c19cce7224af29628cd10c218444d5c0e8fdd1c",
   "sections": {
     "highlights": {
-      "generatedHash": "488ce0a2eadd5a3718a22b68227f42dbba6f3f57b1ad9259cc850c397318a977",
-      "humanOwned": false
+      "generatedHash": "f65d8fae76964a512b64091b27881c1618ccb0399e3438d6396c0090a5564fbe",
+      "humanOwned": true
     },
     "upgrades": {
-      "generatedHash": "68d4c3318e7ef9c9bc7e5f85be654e3c5ffc027eed6f48b6e3607d091bdbbfb4",
-      "humanOwned": false
+      "generatedHash": "e4d70417d0224b264a39eb96709c1e22c5ee1b95d30ad4aafb3f531e077791a7",
+      "humanOwned": true
     }
   }
 }

.github/scripts/check_plugin_source_compatibility.mts

@@ -60,11 +60,10 @@ function lineEndsNaturally(line: string): boolean {
   );
 }
 
-function hardWrappedLines(content: string): number[] {
+function* hardWrappedLines(content: string): Generator<number> {
   const lines = content.split(
     /\r\n|[\n\r\v\f\u001c-\u001e\u0085\u2028\u2029]/u,
   );
-  const offenders: number[] = [];
   let inFence = false;
   let inFrontmatter = content.startsWith("---\n");
   for (let index = 0; index < lines.length - 1; index++) {
@@ -85,9 +84,8 @@ function hardWrappedLines(content: string): number[] {
     if (LIST_ITEM.test(followingLine) || lineEndsNaturally(line)) continue;
     if (!/[A-Za-z0-9`]$/u.test(stripped)) continue;
     if (!/^[A-Za-z0-9`(]/u.test(followingLine.trim())) continue;
-    offenders.push(index + 1);
+    yield index + 1;
   }
-  return offenders;
 }
 
 function sourceCompatibilityErrors(pluginRoot: string): string[] {

.github/scripts/invoice-desk-source.mjs

@@ -0,0 +1,53 @@
+import { execFileSync } from "node:child_process";
+import { closeSync, mkdirSync, openSync } from "node:fs";
+import { dirname, resolve, sep } from "node:path";
+import { isMain } from "../../sdk/typescript/scripts/is-main.mjs";
+
+export function extractApplication(repository, sha, destination) {
+  const git = (args) =>
+    execFileSync("git", args, { cwd: repository, maxBuffer: Infinity });
+  // Read committed blobs directly: export-ignore and export-subst must not alter scan input.
+  const entries = new TextDecoder("utf-8", { fatal: true })
+    .decode(git(["ls-tree", "-rz", `${sha}:examples/invoice-desk/app`]))
+    .split("\0")
+    .filter(Boolean)
+    .map((entry) => {
+      const tab = entry.indexOf("\t");
+      const [mode, type, oid] = entry.slice(0, tab).split(" ");
+      const path = entry.slice(tab + 1);
+      const output = resolve(destination, path);
+      if (!["100644", "100755"].includes(mode) || type !== "blob") {
+        throw new Error(
+          "The application source must contain only regular files.",
+        );
+      }
+      if (!output.startsWith(resolve(destination) + sep)) {
+        throw new Error("The application source contains an unsafe path.");
+      }
+      return { oid, output };
+    });
+  if (entries.length === 0) throw new Error("The application source is empty.");
+  mkdirSync(destination);
+  for (const { oid, output } of entries) {
+    mkdirSync(dirname(output), { recursive: true });
+    const descriptor = openSync(output, "w");
+    try {
+      execFileSync("git", ["cat-file", "blob", oid], {
+        cwd: repository,
+        stdio: ["ignore", descriptor, "pipe"],
+      });
+    } finally {
+      closeSync(descriptor);
+    }
+  }
+  return entries.length;
+}
+
+if (isMain(import.meta.url)) {
+  const count = extractApplication(
+    process.env.SOURCE_REPOSITORY,
+    process.env.SOURCE_SHA,
+    process.env.SCAN_SOURCE,
+  );
+  console.log(`Extracted ${count} committed application files.`);
+}