feat: measure security scan tokens across workers by mldangelo-oai · Pull Request #265 · openai/codex-security

mldangelo-oai · 2026-08-04T06:17:36Z

Summary

Add cross-worker scan token accounting and expose measured usage through the workbench, scan history, and reporting guidance.
Ship the new usage helper through the public plugin projection without weakening existing public-only runtime protections.

Stack

Intentionally stacked on mdangelo/codex/sync-scan-lifecycle-metadata so this review contains only its atomic upstream change.
Prerequisite for the pending 0.1.6 release in release: bump Codex Security to 0.1.6 #244; package version is unchanged.

Verification

Parsed every bundled workbench Python module.
Verified all 95 declared plugin payload files exist.
Initialized a fresh private workbench SQLite database successfully.
Passed Prettier for all 5 changed formatted files.
The complete reconstructed sync passed 775 tests (5 platform/integration skips) and the installed-package smoke test.

mldangelo-oai · 2026-08-04T06:17:38Z

@codex review

Please review the exact current head a5f8d0c78c587b41f278bb376d9ff398dd23655b and only this atomic PR's declared base-to-head diff.

chatgpt-codex-connector · 2026-08-04T06:18:05Z

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-04T06:19:05Z

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: a5f8d0c78c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-04T06:20:58Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: a5f8d0c78c

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

…can-lifecycle-metadata

…elo/codex/sync-cross-worker-token-usage

mldangelo-oai · 2026-08-04T06:37:59Z

@codex review

Please review the exact updated head 593c550e3ae8bffdde70e4e3fb70b808c9382da2. This additive update ships the exact generated MCP runtime from the same original upstream commit and preserves the atomic base-to-head diff.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 593c550e3a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-04T06:44:03Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: 593c550e3a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

…elo/codex/sync-cross-worker-token-usage

mldangelo-oai · 2026-08-04T07:02:09Z

@codex review

Please review the exact updated head 9e616407d6cc7e219d52a2a4bd8e4ad0d03aa84b. The parent preserves repairable completion failures, and usage accounting now includes cached input in total tokens and honors alternate cache-write fields with a direct Python-boundary regression test.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e616407d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-04T07:07:18Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: 9e616407d6

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

mldangelo-oai · 2026-08-04T07:12:23Z

@codex review

Please review the exact updated head bb4ed32c1c11a1fdd1b98726fd0ab5944b8b0a4c. Accurate cached-token accounting and alternate cache-write regression coverage are preserved, and the test now merges cleanly with existing live-progress PR #261.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb4ed32c1c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-04T07:17:44Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: bb4ed32c1c

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

The base branch was changed.

mldangelo-oai · 2026-08-04T16:55:05Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2cf41714d7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-04T16:59:59Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2cf41714d7

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

mldangelo-oai added 2 commits August 3, 2026 18:57

feat: persist scan lifecycle and model metadata

52020d9

feat: measure security scan tokens across workers

a5f8d0c

mldangelo-oai added 4 commits August 3, 2026 23:35

Merge remote-tracking branch 'origin/main' into mdangelo/codex/sync-s…

52a5a87

…can-lifecycle-metadata

Merge branch 'mdangelo/codex/sync-scan-lifecycle-metadata' into mdang…

d59e48a

…elo/codex/sync-cross-worker-token-usage

fix: ship the matching bundled MCP runtime

6e9f17d

fix: ship the matching bundled MCP runtime

593c550

chatgpt-codex-connector Bot reviewed Aug 4, 2026

View reviewed changes

mldangelo-oai added 3 commits August 4, 2026 00:00

fix: keep repairable scan finalization failures resumable

9dfdb63

Merge branch 'mdangelo/codex/sync-scan-lifecycle-metadata' into mdang…

f0434fa

…elo/codex/sync-cross-worker-token-usage

fix: retain cached input in measured scan token totals

9e61640

mldangelo-oai mentioned this pull request Aug 4, 2026

Sync the bundled Codex Security plugin #260

Open

chatgpt-codex-connector Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_cli.py

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_scan_usage.py

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_scan_usage.py

test: avoid live-progress token-test import conflict

bb4ed32

chatgpt-codex-connector Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_scan_usage.py

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_scan_usage.py

kmbroai previously approved these changes Aug 4, 2026

View reviewed changes

ianw-oai previously approved these changes Aug 4, 2026

View reviewed changes

Base automatically changed from mdangelo/codex/sync-scan-lifecycle-metadata to main August 4, 2026 16:34

github-actions Bot added the enhancement New feature or request label Aug 4, 2026

chore: merge main into cross-worker token usage

2cf4171

mldangelo-oai requested review from ianw-oai and kmbroai August 4, 2026 16:55

chatgpt-codex-connector Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread sdk/typescript/_bundled_plugin/references/final-report.md

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_scan_usage.py

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_db.py

kmbroai approved these changes Aug 4, 2026

View reviewed changes

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_db.py

zcrab-oai approved these changes Aug 4, 2026

View reviewed changes

mldangelo-oai merged commit f9826a5 into main Aug 4, 2026
15 checks passed

mldangelo-oai deleted the mdangelo/codex/sync-cross-worker-token-usage branch August 4, 2026 17:35

Uh oh!

Conversation

mldangelo-oai commented Aug 4, 2026

Summary

Stack

Verification

Uh oh!

mldangelo-oai commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

mldangelo-oai commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

mldangelo-oai commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

mldangelo-oai commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

mldangelo-oai commented Aug 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants