fix(cli): return safe structured scan failure details by mldangelo-oai · Pull Request #463 · openai/codex-security

mldangelo-oai · 2026-08-15T19:45:33Z

Summary

Return privacy-safe, machine-readable errors when scans or saved scan reruns fail in JSON or JSONL mode.

Addresses the structured-output request in #375.

Changes

Preserve SCAN_FAILED and SCAN_REPLAY_UNAVAILABLE error envelopes on structured stdout, including failures finding the latest completed scan.
Render a closed JSON/JSONL failure payload so incidental framework metadata cannot enter the error contract. Preserve the normal and --full-output envelope shapes.
Use fixed messages for authentication, connectivity, timeout, cost-limit, protected-directory, local-input, and cybersecurity-policy failures. Keep upstream details out of structured errors.
Preserve the local origin and detailed diagnostics of knowledge-base and plugin setup errors, including their cause and cancellation behavior. Local plugin errors use LocalPluginBootstrapError, which remains compatible with existing PluginBootstrapError catches. Keep installer subprocess failures distinct from local selection, ZIP manifest, and marketplace-copy failures.
Recognize typed contract-validation and authentication errors directly, using the existing fixed local-input and authentication messages.
Preserve detailed stderr diagnostics, partial-output guidance, plain-text behavior, and existing exit codes, including interruption codes.
Cover these paths with injected CLI dependencies and synthetic credentials and identifiers.
Merge current main while preserving its Linear commands and the reviewed error-output behavior.

Testing

On 2a37ea13, the neutral typed-error and plugin-error compatibility tests plus existing CLI discovery/help checks passed: six tests, zero failures, 365 assertions.
pnpm run types, pnpm run format, and git diff --check: passed.
Build, pack, and the existing static package-contract check with an explicit plugin contract: passed.
A private consumer installed the exact archive with install scripts disabled. All 222 installed package files matched the archive; public SDK import, --version, --help, and patch --help passed.
The full installed-package smoke and security-specific regression cases were not rerun for this main integration and ordinary error-contract follow-ups. Their existing source and prior evidence are preserved.
The earlier randomized full suite on 301e5415 passed 1,299 tests with 11 skips and zero failures after one unchanged timeout retry. That result is historical; a new full suite was not run.
Three fresh source-only native reviews and independent verification passed with no findings. Pushed-head CI is still required.

Risk and rollout

Structured scan failures now return a safe error envelope instead of empty stdout. They remain complete and parseable when token-count or truncation flags are supplied; successful-result and discovery formatting are unchanged. Local knowledge-base errors use the existing ConfigurationError type. Local plugin setup errors use the compatible LocalPluginBootstrapError subtype, with underlying failures available through cause; installer errors are unchanged. Detailed stderr may still contain local diagnostic context. This does not change scan execution, model moderation, refusal policy, account permissions, or partial-result sealing.

The main integration adds no new plugin or npm version. Preserve the current draft state and recheck current main before merge.

Public disclosure review

Newly authored material was reviewed for public disclosure. Existing automated review comments contain access-restricted report references; maintainer cleanup remains outstanding.

No customer, partner, prospect, or user identities, data, or identifying details are included.
No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

mldangelo-oai · 2026-08-15T19:45:43Z

@codex review

chatgpt-codex-connector · 2026-08-15T19:47:45Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 9c71f34d02

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-15T19:47:46Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: 9c71f34d02

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

# Conflicts: # sdk/typescript/src/cli.ts

mldangelo-oai · 2026-08-16T08:10:23Z

@codex review

Please review the current head, 301e54159886185274b956d18ac84756477100cc.

chatgpt-codex-connector · 2026-08-16T08:13:04Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: 301e541598

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

chatgpt-codex-connector · 2026-08-16T08:13:10Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 301e541598

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zcrab-oai

Draft feedback: the CLI classification change should not break the public SDK error contract.

zcrab-oai · 2026-08-16T22:07:26Z

+    return await resolveLocalPluginPath(pluginPath, workspace, signal);
+  } catch (error) {
+    if (signal?.aborted || error instanceof ConfigurationError) throw error;
+    throw new ConfigurationError(errorMessage(error), { cause: error });


[P2] Preserve the public plugin-bootstrap error contract

Could we keep PluginBootstrapError for the publicly exported plugin helpers and classify local failures only at the CLI boundary? resolvePluginPath, createMarketplace, pluginMetadata, and bootstrapPlugin now replace established bootstrap failures with the sibling ConfigurationError, and existing tests had to change their expected error class. SDK integrations that catch the exported bootstrap error will stop handling malformed plugins and unsafe marketplace paths.

mldangelo-oai · 2026-08-17T05:58:47Z

@codex review

Please review commit 2a37ea13b64dcab5648ec50cdbbfef01b4efe0a8.

chatgpt-codex-connector · 2026-08-17T06:00:12Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 2a37ea13b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-17T06:00:48Z

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2a37ea13b6

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

fix(cli): return safe structured scan failure details

9c71f34

github-actions Bot added the bug Something isn't working label Aug 15, 2026

mldangelo-oai added 3 commits August 15, 2026 22:57

Merge main into structured scan failure branch

5c2b912

# Conflicts: # sdk/typescript/src/cli.ts

fix(cli): simplify structured failure reporting

74b354b

fix(cli): preserve local knowledge-base failure origin

82c450f

mldangelo-oai mentioned this pull request Aug 16, 2026

fix: validate private state before access #481

Open

3 tasks

mldangelo-oai added 3 commits August 16, 2026 00:06

fix(cli): preserve local plugin setup failure origins

be5f305

fix(runtime): preserve plugin ZIP manifest diagnostics

d3fd259

fix(cli): render closed structured failure envelopes

301e541

zcrab-oai reviewed Aug 16, 2026

View reviewed changes

mldangelo-oai added 3 commits August 16, 2026 21:39

Merge current main into structured scan failure output

6292cd3

fix(cli): classify typed scan failures

e111e03

fix(sdk): preserve plugin bootstrap error compatibility

2a37ea1

Navigation Menu

Uh oh!

fix(cli): return safe structured scan failure details - #463

fix(cli): return safe structured scan failure details#463
mldangelo-oai wants to merge 10 commits into
mainfrom
mdangelo/codex/structured-scan-failure-output

mldangelo-oai commented Aug 15, 2026 •

edited

Loading

Uh oh!

mldangelo-oai commented Aug 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 15, 2026

Uh oh!

mldangelo-oai commented Aug 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 16, 2026

Uh oh!

zcrab-oai left a comment

Uh oh!

zcrab-oai Aug 16, 2026

Uh oh!

mldangelo-oai commented Aug 17, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 17, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mldangelo-oai commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Risk and rollout

Public disclosure review

Uh oh!

mldangelo-oai commented Aug 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 15, 2026

Uh oh!

mldangelo-oai commented Aug 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 16, 2026

Uh oh!

zcrab-oai left a comment

Choose a reason for hiding this comment

Uh oh!

zcrab-oai Aug 16, 2026

Choose a reason for hiding this comment

Uh oh!

mldangelo-oai commented Aug 17, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 17, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mldangelo-oai commented Aug 15, 2026 •

edited

Loading