Codex Security Files

Highlights

Codex Security 0.5.1 adds hosted patch generation and fix verification, and improves saved-scan replay, Deep Scan recovery, and Windows setup.

• Hosted patching and verification. Integrations can generate patches and independently verify candidate fixes through runHostedRemediation() and its JSON-RPC adapter using a supplied executor. Hosts own checkout isolation, sandbox enforcement, candidate patch identity, and publication. See the hosted remediation guide. (#1684)
• Saved scan settings. Daybreak selections persist across scans and remediation, including fresh and resumed Deep Scan workers. Saved Bedrock scans retain the effective AWS region and profile, and inline patches preserve the selected profile's provider settings. Severity classification uses the saved repository to select helpers. (#1740, #1811, #1810, #1815)
• Deep Scan recovery and progress. Reports retain accepted worker coverage and its original evidence, including coverage recovered after cancellation or a discovery deadline. Standard and diff scans refresh phase and review counts from saved state even when the model emits no new progress markers. (#1593, #1757)
• Windows setup. Runtime preparation uses private workspaces in the state directory so elevated-sandbox permissions on TEMP do not prevent scans from starting. Policy generation supports the default elevated Windows sandbox; see the access details below. Update notices also recognize global installations managed by nvm-windows. (#1803, #1741, #1801)
• Reliable command results. Optional logging, update notices, and scratch cleanup no longer override completed scan, import, or publication outcomes. Failed commands do not print success output, and patch and verification commands wait for required output writes to finish. (#1800, #1818, #1824, #1826, #1775, #1777)

Other fixes

- Saved scopes, component scans, CSV imports, and activity displays preserve literal paths. Helper values beginning with `-` and literal TOML strings retain their values. ([#1812](https://github.com/openai/codex-security/pull/1812), [#1814](https://github.com/openai/codex-security/pull/1814), [#1786](https://github.com/openai/codex-security/pull/1786), [#1827](https://github.com/openai/codex-security/pull/1827), [#1809](https://github.com/openai/codex-security/pull/1809), [#1792](https://github.com/openai/codex-security/pull/1792)) - Basic patching supports Git repositories before their first commit. Directory inventories exclude `.svn` metadata, and component scans include tracked files matched by `.gitignore`. ([#1552](https://github.com/openai/codex-security/pull/1552), [#1768](https://github.com/openai/codex-security/pull/1768)) - Scan history, feedback selection, and automatic matching consistently use scan start times when choosing and comparing results. ([#1772](https://github.com/openai/codex-security/pull/1772), [#1774](https://github.com/openai/codex-security/pull/1774), [#1776](https://github.com/openai/codex-security/pull/1776), [#1779](https://github.com/openai/codex-security/pull/1779)) - SARIF exports preserve sealed scan artifacts. CSV processing preserves large quoted fields and finalized Deep Scan candidate metadata. ([#1769](https://github.com/openai/codex-security/pull/1769), [#1785](https://github.com/openai/codex-security/pull/1785), [#1828](https://github.com/openai/codex-security/pull/1828)) - Canceled fix verification restores an already applied patch's state. Deduplication reviews retry temporary Codex rate-limit errors, and cancellation is honored around embedding callbacks and saved result writes. ([#1819](https://github.com/openai/codex-security/pull/1819), [#1767](https://github.com/openai/codex-security/pull/1767), [#1789](https://github.com/openai/codex-security/pull/1789), [#1821](https://github.com/openai/codex-security/pull/1821)) - Runtime telemetry preserves analytics and OpenTelemetry controls across workers and remediation. ([#1691](https://github.com/openai/codex-security/pull/1691)) - Release automation waits for npm, installed-package checks, the GitHub Action, and container publication. Containers retain their place in the publication queue. ([#1796](https://github.com/openai/codex-security/pull/1796), [#1806](https://github.com/openai/codex-security/pull/1806))

Upgrade notes

Windows policy generation

With the elevated Windows sandbox, policy generation can read other local source, including sibling components. The policy prompt retains the selected component's scope. Credential, configuration, and Git metadata denials, read-only access, and disabled network access remain enforced. Explicit sandbox choices and Unix read scope are unchanged. (#1741)

Saved scans of SVN working copies

Directory scans and patch identities now exclude .svn metadata. If a saved scan or patch included that metadata and no longer matches its source, restart the scan or regenerate the patch. Git diff and working-tree scans still require Git. (#1552)

Custom component and CSV scan clients

Custom component clients and clients handling explicit CSV scopes now receive absolute scan targets. Component callers intentionally using home shorthand should supply an absolute path inside the repository. Saved plans and receipts retain their existing formats, and completed campaign receipts remain reusable. (#1814)

GitHub Action

The Marketplace display name is now OpenAI Codex Security. Use openai/codex-security@action-v0.5.1, or pin the full distribution commit recorded in the Action release manifest. The npm package name remains @openai/codex-security. Marketplace publication is a separate step after the automated release. (#1797)

Upgrading from earlier releases

If upgrading from before 0.5.0, also review the 0.5.0 upgrade notes, including custom capability-preflight integrations and selected-profile approval settings.

If upgrading from before 0.4.0, upgrade CLI and plugin installations together when they share a Codex Security state directory. The shared issue-history migration preserves existing Linear receipts, but older publishers cannot write to the migrated database. (#1426)

All changes

## What's Changed ### Features * feat(remediation): support hosted patch and verification by @mluck-openai in https://github.com/openai/codex-security/pull/1684 ### Fixes * fix: preserve Daybreak settings across scans and remediation by @mldangelo-oai in https://github.com/openai/codex-security/pull/1740 * fix(policy): support the elevated Windows sandbox by @mldangelo-oai in https://github.com/openai/codex-security/pull/1741 * fix(cli): refresh scan progress from saved state by @mldangelo-oai in https://github.com/openai/codex-security/pull/1757 * fix(targets): support unborn Git worktrees and ignore SVN metadata by @mldangelo-oai in https://github.com/openai/codex-security/pull/1552 * fix(telemetry): preserve controls and share request attribution by @mldangelo-oai in https://github.com/openai/codex-security/pull/1691 * fix(inventory): include tracked ignored files in component scans by @mldangelo-oai in https://github.com/openai/codex-security/pull/1768 * fix(cli): select feedback by the latest scan start instant by @mldangelo-oai in https://github.com/openai/codex-security/pull/1776 * fix(reports): preserve sealed SARIF artifacts during export by @mldangelo-oai in https://github.com/openai/codex-security/pull/1769 * fix(findings): order occurrence history by scan start time by @mldangelo-oai in https://github.com/openai/codex-security/pull/1772 * fix(history): use chronological cutoffs for explicit comparisons by @mldangelo-oai in https://github.com/openai/codex-security/pull/1774 * fix(cli): await required patch and verification output by @mldangelo-oai in https://github.com/openai/codex-security/pull/1777 * fix(findings): reject non-finite numbers before storage by @mldangelo-oai in https://github.com/openai/codex-security/pull/1773 * fix(history): read scan counts and latest scans together by @mldangelo-oai in https://github.com/openai/codex-security/pull/1771 * fix(cli): avoid success output after command failures by @mldangelo-oai in https://github.com/openai/codex-security/pull/1775 * fix(sdk): preserve CODEOWNERS token grammar by @mldangelo-oai in https://github.com/openai/codex-security/pull/1787 * fix(ci): stabilize Python discovery and native worker tests by @mldangelo-oai in https://github.com/openai/codex-security/pull/1793 * fix(artifacts): retain finding details with own JSON keys by @mldangelo-oai in https://github.com/openai/codex-security/pull/1780 * fix(history): order automatic matches by scan start time by @mldangelo-oai in https://github.com/openai/codex-security/pull/1779 * fix(config): preserve literal TOML override strings by @mldangelo-oai in https://github.com/openai/codex-security/pull/1792 * fix: preserve validation behavior for malformed scan usage by @mldangelo-oai in https://github.com/openai/codex-security/pull/1781 * fix(csv): preserve record endings in large finding exports by @mldangelo-oai in https://github.com/openai/codex-security/pull/1785 * fix(sdk): honor cancellation around embedding callbacks by @mldangelo-oai in https://github.com/openai/codex-security/pull/1789 * fix(workbench): resolve stdin context after argument parsing by @mldangelo-oai in https://github.com/openai/codex-security/pull/1784 * fix(findings): compare stored numeric JSON exactly by @mldangelo-oai in https://github.com/openai/codex-security/pull/1788 * fix(artifacts): reject non-finite values in retained scan drafts by @mldangelo-oai in https://github.com/openai/codex-security/pull/1783 * fix(release): publish containers with coordinated npm releases by @mldangelo-oai in https://github.com/openai/codex-security/pull/1796 * fix(release): clarify Marketplace publication and channel status by @mldangelo-oai in https://github.com/openai/codex-security/pull/1797 * fix(import): preserve literal CSV paths, candidate IDs, and notes by @mldangelo-oai in https://github.com/openai/codex-security/pull/1786 * fix(reports): keep non-ASCII characters in quoted report paths by @i098 in https://github.com/openai/codex-security/pull/1791 * fix(runtime): keep Windows bootstrap workspaces out of TEMP by @mldangelo-oai in https://github.com/openai/codex-security/pull/1803 * fix(sdk): retry deduplication reviews on Codex rate limits by @Shizoqua in https://github.com/openai/codex-security/pull/1767 * fix(deep-scan): include accepted worker coverage in reports by @mldangelo-oai in https://github.com/openai/codex-security/pull/1593 * fix(targets): ignore log.showSignature when reading commit subjects by @LittleYier in https://github.com/openai/codex-security/pull/1805 * fix(severity): use saved scan context for helper selection by @mldangelo-oai in https://github.com/openai/codex-security/pull/1815 * fix(cli): preserve literal paths when replaying saved scopes by @mldangelo-oai in https://github.com/openai/codex-security/pull/1812 * fix(sdk): preserve effective Bedrock settings in saved recipes by @mldangelo-oai in https://github.com/openai/codex-security/pull/1811 * fix: preserve helper values that start with a dash by @mldangelo-oai in https://github.com/openai/codex-security/pull/1809 * fix(config): align source attribution with merged settings by @mldangelo-oai in https://github.com/openai/codex-security/pull/1807 * fix(release): improve release note structure and formatting by @mldangelo-oai in https://github.com/openai/codex-security/pull/1804 * fix(scopes): preserve literal component and CSV paths by @mldangelo-oai in https://github.com/openai/codex-security/pull/1814 * fix(runtime): extract plugin ZIPs from the checked descriptor by @mldangelo-oai in https://github.com/openai/codex-security/pull/1808 * fix(retry): honor waits longer than the Node timer limit by @mldangelo-oai in https://github.com/openai/codex-security/pull/1813 * fix(cli): preserve profile provider settings for inline patches by @mldangelo-oai in https://github.com/openai/codex-security/pull/1810 * fix(cli): preserve results when update notices fail by @mldangelo-oai in https://github.com/openai/codex-security/pull/1800 * fix(findings): retry failed runtime initialization by @sylvesterkaczmarek in https://github.com/openai/codex-security/pull/1334 * fix(validation): read provisional documents through checked descriptors by @mldangelo-oai in https://github.com/openai/codex-security/pull/1822 * fix(severity): propagate cancellation to saved-scan history by @mldangelo-oai in https://github.com/openai/codex-security/pull/1823 * fix(exports): retain finalized Deep CSV candidate metadata by @mldangelo-oai in https://github.com/openai/codex-security/pull/1828 * fix(mcp): isolate optional Deep Scan logger failures by @mldangelo-oai in https://github.com/openai/codex-security/pull/1818 * fix(activity): preserve literal paths before display formatting by @mldangelo-oai in https://github.com/openai/codex-security/pull/1827 * fix(import): preserve outcomes when scratch cleanup fails by @mldangelo-oai in https://github.com/openai/codex-security/pull/1824 * fix(workbench): restore applied state after verification cancellation by @mldangelo-oai in https://github.com/openai/codex-security/pull/1819 * fix(cli): enforce CSV stdout rules for accepted format aliases by @mldangelo-oai in https://github.com/openai/codex-security/pull/1825 * fix(cli): preserve publication outcomes when diagnostics fail by @mldangelo-oai in https://github.com/openai/codex-security/pull/1826 * fix(threat-model): show non-string legacy origins as not recorded by @WenJing95 in https://github.com/openai/codex-security/pull/1802 * fix(dedupe): observe cancellation after completed writes by @mldangelo-oai in https://github.com/openai/codex-security/pull/1821 * fix(cli): detect nvm-windows global installs in update notices by @WenJing95 in https://github.com/openai/codex-security/pull/1801 ### Other changes * chore(deps): update Zod to 4.6.7 by @dependabot[bot] in https://github.com/openai/codex-security/pull/1816 * chore(deps): bump hono from 4.13.10 to 4.13.13 in /evals/triage-finding by @dependabot[bot] in https://github.com/openai/codex-security/pull/1832 ## New Contributors * @Shizoqua made their first contribution in https://github.com/openai/codex-security/pull/1767 **Full Changelog**: https://github.com/openai/codex-security/compare/npm-v0.5.0...npm-v0.5.1