fix: complete the bundled scan example

[mldangelo-oai]

Summary

Make the bundled completed-scan example usable by tracking preflight, including installations that already cached the previous plugin version.

Changes

• Add the report generated from the example's existing canonical JSON.
• Include the report in the exact bundled-plugin package manifest.
• Run tracking preflight against the unchanged example in a focused regression test.
• Advance both bundled-plugin version markers from 0.1.20 to 0.1.21 so existing SDK plugin caches receive the completed example.
• Leave the npm package version and sealed canonical JSON unchanged.
• Merge public main b4fe2d87 additively. The five-file PR diff is unchanged.

Testing

Current main-merge head dfbe1d23:

• Focused contract suite with Bun 1.3.14 and seed 12345: 31 passed, 0 failed, 100 assertions.
• Types, formatting, build, package creation, package-contract check, and separate installed-package smoke: passed. The first sandboxed package check stopped on npm-cache permissions; the unchanged command passed with normal cache access.
• Verified all 107 bundled-plugin files in the 223-entry archive against the committed source. The report and canonical JSON remain byte-identical to the previously verified bundle; plugin version is 0.1.21 and npm version is 0.1.14.
• Three independent native source-review passes and a fresh verification: no findings or blockers.

The full randomized suite at historical head db2b2765 passed 1,294 tests with 11 expected skips and 0 failures. It was not rerun for this package-only main merge. Fresh pushed-head cross-platform CI remains required.

Risk and rollout

The report is a derived artifact; this change does not alter the sealed canonical scan JSON or scan runtime behavior. The paired plugin-version update is required because the SDK refreshes an existing marketplace cache when the selected plugin version changes.

If another plugin-bearing change merges first, refresh this branch against main and advance both version markers to the next unused plugin version before shipping. This pull request does not change the npm version, create a release tag, or publish a release.

Public disclosure review

Newly authored material was reviewed for public disclosure. Existing automated review comments contain access-restricted report references; maintainer cleanup remains outstanding.

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the current head f4c7cf1.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: f4c7cf135b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: f4c7cf135b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

The validation record is complete. The code head remains f4c7cf1; the ordinary and randomized suites and installed-package smoke all passed.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: f4c7cf135b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: f4c7cf135b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Please review the current head, db2b2765becacdbc35335a96e48c6af731031d17.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: db2b2765be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: db2b2765be

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review Please review current head db2b276, including the additive bundled-plugin cache version refresh.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: db2b2765be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: db2b2765be

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[zcrab-oai]

Reviewed the completed-scan example, canonical artifacts, package manifest, and synchronized plugin versions.

[mldangelo-oai]

@codex review

Please review the current head, dfbe1d23cd30edcc37ff5d46c24eaa61e94ae29f.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: dfbe1d23cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: dfbe1d23cd

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.