Skip to content

fix: safely inventory security-relevant diff changes - #89

Open
mldangelo-oai wants to merge 51 commits into
mainfrom
mdangelo/codex/safe-complete-diff-inventory
Open

fix: safely inventory security-relevant diff changes#89
mldangelo-oai wants to merge 51 commits into
mainfrom
mdangelo/codex/safe-complete-diff-inventory

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Include changed first-party workflows, local actions, instructions, infrastructure, containers, and other security-relevant text in diff scans.
  • Preserve selected Git revisions, staged and unstaged changes, executable binary deletions, worktree deletions, renames, and initialized or uninitialized submodule pins.
  • Keep untracked files outside the declared patch scope and reject symbolic links, unsafe paths, non-regular files, and hard-linked working-tree previews.
  • Require argument-based Git reads with replacement objects disabled instead of interpolating repository-controlled paths into shell commands.
  • Treat every repository-controlled Git pathspec literally, including index/worktree comparisons and full-review source reads.
  • Verify complete Git object hashes and fail closed for corrupt objects, recreated staged deletions, dirty submodules, symlinked submodule paths, or uninitialized conflicted directories.

Verification

  • bun test tests-ts/diff-rank-input.test.ts (34 passed).
  • Full SDK suite: 1,021 passed, 11 skipped, 0 failed.
  • SDK type and formatting checks.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dfab5666dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py

@ianw-oai ianw-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two blockers: the diff inventory omits real first-party security-sensitive files and forwards unsafe symlinks or pipes to full-file reviewers. Both are reproduced. Please fix inventory completeness and reject unsafe paths before review.

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
ianw-oai
ianw-oai previously approved these changes Jul 29, 2026

@ianw-oai ianw-oai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Michael will address the previously noted security-sensitive inventory and special-file issues.

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact pushed head c8e9656, including fail-closed diff inventory and the contributor-attributed immutable diff snapshot fix from PR #112.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8e965670f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_db.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_db.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_target.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_target.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact pushed head 65b0b52. Contributor-authored immutable diff support is retained; Python smoke now disables bytecode generation so npm archives cannot accidentally include pycache artifacts.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 65b0b52b83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact pushed head b411a5f, including preserved Create Something authorship, immutable tree-object digests, revision-accurate Git blob review, disabled replacement refs, and safe legacy digest backfills.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b411a5f046

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_db.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review exact pushed head d9cb861, including preserved Create Something and GautamSharma99 contributions, immutable Git-object digests, trusted absolute Git execution, disabled replacement refs, and revision-correct previews.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d9cb861759

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/workbench_constants.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review exact head 8efca11d6f807710d7f2113e44f9b6bdff1b4561

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review exact head 8efca11

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8efca11955

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8efca11955

View security finding report

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review exact head ce102af

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 7daad6b851

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review the exact current head 1670a68. Focus on initialized submodule conflicts, per-stage executable modes, and replacement-safe Git object reads.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1670a68e06

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 1670a68e06

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review the exact current head cd04e32. Focus on mixed initialized submodule conflicts, binary executable stage modes, and replacement-safe object reads.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd04e3241b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: cd04e3241b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

# Conflicts:
#	sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review the exact current head 65bfbe6. Focus on the main-branch merge, preserved scoped-inventory protections, literal Git pathspecs, mixed submodule conflicts, and binary stage modes.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65bfbe65db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review the exact current head aa55f4e. Check binary executable merge-conflict stages and working-tree resolutions, unreadable Git objects, initialized submodules, and the preserved scoped-inventory protections.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa55f4eaf0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: aa55f4eaf0

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review the exact current head 32c9ef1. Verify literal Git pathspecs and returned-path verification for committed, staged, unresolved, and submodule changes, together with binary executable previews.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 32c9ef1a5a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 32c9ef1a5a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review the exact current head bb03bfb. Focus on complete Git object verification, literal pathspecs, initialized submodule safety, executable deletions, and mixed staged/worktree changes.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb03bfb54c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py
Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: bb03bfb54c

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Comment thread sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py Outdated
@mldangelo-oai

Copy link
Copy Markdown
Collaborator Author

@codex review the exact current head 2abe213. Verify hash-validated Git object reads, literal staged-object lookup, recreated staged deletions, and the focused working-tree regression.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 2abe21376d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2abe21376d

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants