feat(sdk): attribute Responses traffic to SDK and CLI

[mldangelo-oai]

Summary

• Attribute SDK scans to sdk and CLI scans, validation/patch commands, and semantic scan comparisons to cli through responses_api_metadata.codex_security_surface.
• Export createSecurity while keeping CLI-versus-SDK runtime selection internal.
• Add focused regression coverage for both scan surfaces and CLI skill-command configuration, with environment-value coverage in its dedicated test module.

Why

Responses traffic from Codex Security needs an explicit surface marker so product analytics can distinguish requests originating from the public SDK and CLI.

Verification

• bun test --randomize --seed 12345 --timeout 30000 ./tests-ts — 1,008 passed; 11 platform-specific tests skipped.
• bun test --timeout 30000 tests-ts/api-environment.test.ts tests-ts/api-surface.test.ts tests-ts/cli-skills.test.ts tests-ts/scan-comparison.test.ts — 30 passed.
• pnpm run types
• pnpm run format
• pnpm run build
• pnpm pack and pnpm run check:package -- <tarball> — verified the 203-entry release artifact, installed public import and CLI, 107 bundled plugin files, bundled Codex, and a nested worker.

[mldangelo-oai]

@codex review the exact current head e47c180. Focus on CLI-versus-SDK Responses metadata across scans, semantic comparisons, validation/patch commands, and the public createSecurity factory.

[mldangelo-oai]

@codex review the exact current head 3a152c3. Verify CLI-versus-SDK Responses attribution and that the focused attribution and environment tests match the approved change.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 3a152c3f02

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 3a152c3f02

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[kmbroai]

responses_api_metadata cool