[mldangelo-oai]

Summary

Install @openai/codex-security@latest from npm and check startup daily so installation failures remain visible after release. Existing package tests continue to check the archive built from each commit.

Changes

• Run on a daily schedule, manual dispatch, and pull requests that change these checks. Cover Linux Node 22/24/26, macOS Node 24, and Windows Node 24.
• Check the installed npm CLI shim and version, public SDK import, bundled Codex executable, and bundled MCP initialization from a temporary consumer. Use temporary configuration directories and clean up afterward.
• Share npm lookup with the existing archive smoke script. Use Node's subprocess support for the new check and leave the archive command runner unchanged.
• Keep regression tests for an incorrect installed CLI version and a CLI startup failure, including paths with spaces.

Testing

• Eight focused installation/timeout tests, SDK types/format, changed-file formatting, and diff checks passed.

• A live npm install of published version 0.1.31 passed the CLI, SDK, Codex, and MCP checks on Linux Node 22 while the checkout was version 0.1.32.

• Full local SDK runs encountered pre-existing host-layout and permission failures, also reproduced in the original checkout. Full hosted CI covers the supported environments.

• Three independent native reviews and a fresh verification pass found no actionable regressions.

Risk and rollout

The workflow follows npm's current latest package and dependency resolution. Registry outages or broken published dependencies can fail it independently of source changes. The checks perform local startup operations without scans or model API calls. Public CLI behavior is unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T18:11:20.184792Z	b0dc533	New commits
🔒 Security Review	✅ Completed 2026-09-30T18:13:33.332272Z	b0dc533	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[soyeon-oai]

Reviewed the consumer isolation, installed-version assertions, cross-platform launchers, and shared npm lookup. No actionable findings. Inspected the successful hosted smoke jobs, including Windows/macOS logs; I did not independently run tests.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused workflow and smoke checks are consistent with existing packaging behavior and contain no identified blocking issues.

Review effort: Balanced
Findings: None

What changed in this PR

Adds daily, cross-platform validation of the latest published npm package.

Changes:

• Adds Linux, macOS, and Windows smoke-test workflow coverage.
• Verifies CLI, SDK, bundled Codex, and MCP startup.
• Extracts shared npm resolution and documents the workflow.

File	Description
.github/​workflows/​published-install-smoke.yml	Defines the scheduled platform matrix.
RELEASING.md	Documents operation and local reproduction.
sdk/​typescript/​scripts/​package-smoke-npm.mjs	Provides shared npm resolution.
sdk/​typescript/​scripts/​smoke-package.mjs	Uses the shared resolver.
sdk/​typescript/​scripts/​smoke-published-package.mjs	Implements published-package verification.
sdk/​typescript/​tests-ts/​published-install-smoke.test.ts	Covers CLI version and startup failures.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.