feat(sdk): expose headless patch generation - #774
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsBlocking findings (2)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: e071faa9b1
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 08cdfc9323
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8f69987795
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9825b0b7a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 55cb677e2a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e4e77a11af
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d9c787670
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 42d5d2eaf9
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
| const projectRoot = await codexProjectRoot( | ||
| repository, | ||
| session.sessionConfig, | ||
| ); |
There was a problem hiding this comment.
Requires a host-wide Codex config with custom project_root_markers and a nested patch target. Fresh evidence beyond the prior marker-root fix is that Codex's own preflight loads the system layer before $CODEX_HOME, while this code resolves only session.sessionConfig; with no constructor override it therefore assumes .git. A contributor can commit the system marker plus a nested .codex/config.toml; the override is applied to the Git root, workingDirectory trusts the actual nested root, and its MCP command runs with host permissions. Resolve the root from every configuration layer Codex will load before starting the thread.
SECURITY.md reference: SECURITY.md:L63-L68
Dismiss this finding: Reply with @codex security dismiss <reason> [context]. Codex will resolve this conversation automatically; GitHub may require a page refresh to show the result.
Valid reasons: false-positive, duplicate, out-of-scope, compensating-control, risk-accepted, or other. Example: @codex security dismiss duplicate Already flagged by another review
What each reason means
false-positive— Not a vulnerabilityduplicate— Already tracked elsewhereout-of-scope— Outside this review's scopecompensating-control— Mitigated by another controlrisk-accepted— Risk intentionally acceptedother— Another reason; context required
Useful? React with 👍 / 👎.
|
This API now matches our approval-gated remediation use case: patch an isolated workspace, return structured verification, and leave authoritative diff capture, approval, commit creation, PR delivery, and finding closure to the caller. Before adoption, we need the remaining project-trust issue resolved. An SDK patch operation must fail closed regardless of system-level For an embedding-safe default, please consider disabling repository MCP servers for
|
|
I checked the structured finding path. Object findings are passed through One non-blocking SDK contract improvement would help embedding applications: Please consider exporting a reusable |
2 participants
Summary
Fixes #681.
The TypeScript SDK can scan and validate findings, but generating a verified patch currently requires applications to launch and supervise the CLI. Add
CodexSecurity.patch()so approval-gated remediation systems can run the existing fix-finding workflow through the SDK without parsing terminal output or delegating commit and publication control.The required syntax is
patch({ repositoryPath, finding }). Authentication defaults to"auto"; model and reasoning effort default to the constructor configuration and can be overridden per call. The supplied workspace is intentionally mutable. The SDK never commits, pushes, publishes, opens a pull request, or changes remote finding state. Existing Codex project trust is preserved, and a workspace without a saved trust decision is treated as untrusted before the patch thread starts.Changes
PatchOptionsand a readonly, discriminatedPatchResultunion forverified,no_change,blocked, andfailedoutcomes. Successful/no-change outcomes require verification proof; blocked/failed outcomes require a reason. Use a Responses-compatible root object schema with required nullable wire fields, then normalize it back to the discriminated public result.fix-findingskill through the existing SDK runtime, authentication, provider, cancellation, activity, session-event, reconnect, and cost-tracking boundaries.project_root_markers(defaulting to.git), including configured package markers, existing.gitmarkers, and worktree subdirectories. Preserve only that exact root'strusted/untrusteddecision through a raw, path-quoted SDK config override; do not inherit trust from an enclosing worktree across a custom marker boundary, and default an unlisted root tountrustedsoworkingDirectorycannot persist trust and activate repository-local Codex configuration or MCP servers.No public CLI commands, arguments, flags, accepted values, environment variables, or defaults change.
Testing
bun test --timeout 30000 tests-ts/api-patch.test.ts --seed 12345— 28 passed, 0 failed.api,api-patch, andcli-patch-trust, seed 12345) — 178 passed, 2 platform skips, 0 failed.api-patch,api,cli-skills, andcli-patch, seed 12345) — 210 passed, 2 platform skips, 0 failed.pnpm run types— passed, including generated models, MCP typecheck, and SDK TypeScript checks.pnpm run buildandpnpm run format— passed.pnpm run test:mcp— all 23 test files passed.pnpm pack— passed; the resulting archive contained 390 validated entries, andcheck-package.mjspassed.pnpm run check:plugin-source,python .github/scripts/check_plugin_source_compatibility.py, andgit diff --check— passed.pnpm run test --seed 12345was attempted on unsupported Node 25 and was not used as passing validation. It reached the same seven unchangedcodex-review.test.tsfixture failures reproducible onmain, then was interrupted after those deterministic failures appeared. The new patch tests had already passed in that run.@openai/codex@0.149.1dependency (ETARGET). Archive validation and strict local consumer compilation passed instead.Risk and rollout
This is an additive public SDK method and type surface. Existing scan, validation, CLI patch, authentication, and publication behavior is unchanged. The method can leave partial workspace edits when the model reports failure, the turn is interrupted, or result validation fails; callers must use a disposable or otherwise controlled workspace and inspect or discard its diff.
changedFilesis model-reported metadata rather than an authoritative patch artifact. Cost isnullwhen pricing or usage is unavailable.A resolved project root explicitly marked trusted retains its ability to load project configuration, including configured MCP servers that run with host permissions rather than the patch thread sandbox. Trust is not inherited from an enclosing worktree across a custom marker boundary. Untrusted roots and roots without a saved decision remain untrusted when
patch()supplies the working directory. Unix trust keys must match the exact resolved root; Windows canonical path aliases are accepted, and conflicting aliases fail closed tountrusted.The first SDK surface intentionally excludes patch-risk assessment, commit creation, pull-request creation, publication, and finding closure. Those remain existing CLI or caller-owned workflows.
Public disclosure review