feat(sdk): honor command auth and renewable embeddings credentials

[kmbroai]

Summary

Honor explicitly selected native Codex command authentication across scan preflight, scans, comparisons, and deduplication reviews. Allow SDK callers to supply renewable embeddings credentials without dummy API keys.

Changes

• Preserve provider and profile selection and the native model_providers.<id>.auth configuration instead of importing managed credentials or injecting an ambient API key. Native Codex executes the helper and renews its token.
• Resolve implicit and relative helper working directories from the supplied Codex home; preserve absolute and home-relative directories. Keep review hosts outside the source checkout, existing thread restrictions, and credential isolation. Preserve provider IDs containing dots when forwarding configuration.
• Preserve the calling component scan's explicit authentication choice in planning and matching. Reject conflicting ambient command providers before helper startup, including providers selected by an ambient profile; explicitly configured SDK command providers keep their existing precedence.
• Accept a static embeddings key or () => string | Promise<string> in the existing embedder constructor, resolving the callback before each HTTP batch. Expose the embedder and the existing server/store integration through @openai/codex-security/server without starting a listener on import.
• Reuse CODEX_SECURITY_EMBEDDINGS_URL from feat: allow configuring the findings embeddings URL #765 with its full-URL semantics, OpenAI default, and Compose wiring unchanged. No new CLI flags, endpoint settings, dependencies, or token-refresh implementation.

Testing

• Focused authentication, comparison, component-scan, and review regressions: 82 passed, 6 platform skips. The new auth-conflict regression reproduced the provider switch before the fix and now verifies rejection before a model turn, with explicit command configuration as a passing control. Corrected the existing provider-home fixture to use a platform-native path for Windows.
• Full SDK suite on Node 22.13.1 and Bun 1.3.14 (pnpm run test --seed 12345 and pnpm run test, random seed 1234275873): each run passed 2,143 tests with 41 platform/integration skips and 0 failures across 113 files.
• pnpm run types, pnpm run format, and git diff --check: passed.
• Package integration validation for the new server export: pnpm pack (including plugin and TypeScript/dashboard builds) and pnpm run check:package passed. Covers the installed server import, strict NodeNext consumer, CLI and SDK lifecycle, credential locking, bundled runtime, and nested worker.
• Localhost checks with Codex 0.149.1 confirmed that comparisons and reviews use the native helper token, never the competing ambient keys or the helper placed in the source checkout. The synthetic provider returned HTTP 401; no live provider credentials were used.

Risk and rollout

The callback and server subpath are additive SDK APIs; authentication reporting adds method: "command". Static-key embeddings behavior, request/response handling, and endpoint configuration are preserved. Callers own embeddings token acquisition, and callback failures do not fall back to previous or ambient credentials.

Component planning reports an error when explicit authentication conflicts with an ambient command provider; final matching reports incomplete matching and retains the completed scan artifacts.

Relative helper directories now resolve from the supplied Codex home. Native configuration validation remains authoritative: unsupported legacy inline profiles are still rejected by Codex 0.149.1. Profile forwarding is covered by orchestration tests; the native localhost checks use direct provider selection. Release through the normal package process after review and CI.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-01T00:03:15.324619Z	9f201f6	New commits

Security findings

Blocking findings (2)

• 🔴 Honor explicit auth before ambient command providers · High · Dismissed · From earlier review · 2699462
• 🔴 Keep command-auth executables out of scanned repositories · High · Dismissed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 2699462128

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 9f201f6ce8

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.