fix: make diff-scan writeups and hardening optional

[mldangelo-oai]

Summary

• Make optional vulnerability writeups and hardening portfolios genuinely optional for diff scans.
• Align diff-scan instructions with the artifact contract without weakening required canonical scan outputs.

Stack

• Intentionally stacked on mdangelo/codex/repair-workbench-migration-collisions so this review contains only its atomic upstream change.
• Prerequisite for the pending 0.1.6 release in release: bump Codex Security to 0.1.6 #244; package version is unchanged.

Verification

• Parsed every bundled workbench Python module.
• Verified all 105 declared plugin payload files exist.
• Initialized a fresh private workbench SQLite database successfully.
• Passed Prettier for all 2 changed formatted files.
• The complete reconstructed sync passed 775 tests (5 platform/integration skips) and the installed-package smoke test.

[mldangelo-oai]

@codex review

Please review the exact current head f9cd6846c9a1f0c54bca55ec449de34de1818082 and only this atomic PR's declared base-to-head diff.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: f9cd6846c9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: f9cd6846c9

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the exact updated head 4c6763e289169c83ab73021a45d1b6a58f409a3d. This additive update ships the exact generated MCP runtime from the same original upstream commit and preserves the atomic base-to-head diff.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: c68a301674

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Security Review

codex-security/sdk/typescript/_bundled_plugin/scripts/generate_in_scope_files.py

Line 71 in c68a301

command = ["rg", "--files", "--hidden", "--no-ignore", "--glob", "!.git/**", "--", scope]

Security: Keep ignored secrets out of scan inventories

Adding --no-ignore makes the standard-scan inventory include every .gitignored path, not just ignored tracked files. In a normal repo with .env or ignored dependency trees, prepareCodexSecurityReviewItems feeds those paths into the worklist, and the scan workflow tells the agent to review every returned source file. That can put local credential files into model context without explicit authorization. Use a Git-aware inventory for tracked ignored files, or keep default ignore handling and add tracked ignored paths separately.

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Please review the exact updated head d24c063f41051bd95f2ea30f7717598f2b352004. Inherits regression-tested resumable finalization, accurate cached-token totals, distinct canonical finding identities, complete ignored-file coverage, safe context delegation, and preserved prompt/headless scan identity; the generated runtime remains matched to this original atomic upstream stage.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: d24c063f41

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: d24c063f41

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

The base branch was changed.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: e65018c72b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: e65018c72b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".