feat(cli): share model options across commands by mldangelo-oai · Pull Request #1143 · openai/codex-security

mldangelo-oai · 2026-10-01T05:54:14Z

Summary

Patching and validation required a TOML override to choose a model, while scan commands exposed --model directly. Add consistent model options to these commands and saved-scan matching, while preserving their defaults.

Changes

Add --model MODEL to patch, validate, and verify-fix alongside --effort. Apply the selected settings to patch-risk assessments too.
Add --model MODEL and --effort minimal|low|medium|high|xhigh|max to scans match and scans compare, including scans match --all. Cached matches still require --force to recompute.
Share option schemas and configuration types across the CLI, and test settings at fresh, resumed, and concurrent Deep Scan worker boundaries.
Add GPT-6.1 Sol and GPT-6 Luna prices for cost estimates and --max-cost, including long-context rates from OpenAI's published pricing.

Testing

Hosted node-ci passed on 0092098: 44 jobs passed and two were skipped.
On 0092098, 296 focused configuration, pricing, CLI, and API tests passed, including default-model and model-option coverage. Synthetic worker tests passed for fresh, resumed, and concurrent discovery and reducer workers.
All five portable plugin checks passed, including nine compatibility tests. Bundled-plugin and SDK builds, types, formatting, and git diff --check passed.
Package validation on 0092098 passed for all 528 archive entries. An actual npm installation passed imports, NodeNext types, CLI, SDK lifecycle, credential locking, 142 bundled plugin files, MCP initialization, bundled native execution, dashboard assets, and nested-worker checks.
Both full SDK runs passed on 865d1df: 3,368 passed, 51 skipped, and no failures per run (seeds 12345 and 506805859; 73,303 assertions across 156 files). Those runs preceded main’s dedupe attribution and default-model updates; the final-head checks above cover the later integration. All 37 dedupe tests also passed after the attribution merge.
Three fresh native reviews and independent verification of 0092098 completed with no findings.

Risk and rollout

The new flags are optional. Scans, validation, patching, and verification keep gpt-5.6-sol with xhigh effort; matching uses Codex's configured model with medium effort. Existing --codex settings and conflict checks remain supported. Model IDs continue to pass through to Codex, so availability depends on credentials and provider access.

Public disclosure review

No customer, partner, prospect, or user identities, data, or identifying details are included.
No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

chatgpt-codex-connector · 2026-10-01T05:54:44Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T22:00:44.123554Z	`0092098`	Manual request
🔒 Security Review	✅ Completed 2026-10-01T22:02:15.701578Z	`0092098`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

mldangelo-oai · 2026-10-01T06:14:04Z

@codex review

Please review model/effort forwarding, configuration and pricing behavior, and opportunities to simplify shared schemas and types without changing defaults or accepted CLI values.

chatgpt-codex-connector · 2026-10-01T06:16:25Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 5d31522d6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Copilot review overview

🟡 Changes recommended

Matching commands currently accept and forward whitespace-only model identifiers.

Review effort: Balanced
Findings: 1

Open (1)

Validate and trim blank model values in shared modelOptions schema · New

What changed in this PR

Adds shared model and reasoning-effort options across model-backed CLI commands and updates pricing metadata.

Changes:

Shares model option schemas and configuration types.
Forwards model settings through matching, patching, and verification.
Adds GPT-6.1 Sol and GPT-6 Luna pricing and documentation.

File	Description
`sdk/typescript/src/cli.ts`	Shares and forwards model options.
`sdk/typescript/src/cost-model.ts`	Adds model pricing.
`sdk/typescript/src/api.ts`	Reuses model configuration types.
`sdk/typescript/src/classify-severity.ts`	Reuses runtime option types.
`sdk/typescript/src/security-policy.ts`	Shares preflight model fields.
`sdk/typescript/src/suggest-owners.ts`	Shares owner-report model fields.
`sdk/typescript/README.md`	Documents flags, defaults, and pricing.
`sdk/typescript/tests-ts/api.test.ts`	Tests cost preflight models.
`sdk/typescript/tests-ts/cli.test.ts`	Tests scan model selection.
`sdk/typescript/tests-ts/cli-patch.test.ts`	Tests patch configuration forwarding.
`sdk/typescript/tests-ts/cli-skills.test.ts`	Tests skill model options.
`sdk/typescript/tests-ts/cli-verify-fix.test.ts`	Tests verification options.
`sdk/typescript/tests-ts/cli-workbench.test.ts`	Tests matching options.
`sdk/typescript/tests-ts/cost-context.test.ts`	Tests context pricing.
`sdk/typescript/tests-ts/cost-model.property.test.ts`	Tests pricing calculations.
`plugins/codex-security/mcp-app/tests/test_deep_scan_executor.mjs`	Tests concurrent worker settings.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

soyeon-oai

Source review LGTM: traced model/effort forwarding through patch, verification, risk assessment and matching, conflict checks, and resumed/concurrent worker handling. Explicit model-ID passthrough is intentional. No actionable finding. I did not independently execute tests or verify the external pricing source; no node-ci run for this exact head was visible in the inspected workflow/check results.

mldangelo-oai · 2026-10-01T17:55:45Z

@codex review

chatgpt-codex-connector · 2026-10-01T17:58:09Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 5d31522d6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Copilot review overview

🟢 Approval recommended

The shared option plumbing, pricing updates, documentation, and relevant execution paths are coherently covered by tests.

Review effort: Balanced
Findings: None

Resolved since last review (1)

Validate and trim blank model values in shared modelOptions schema

…model-options # Conflicts: # sdk/typescript/README.md # sdk/typescript/src/cli.ts

mldangelo-oai · 2026-10-01T19:01:03Z

@codex review

chatgpt-codex-connector · 2026-10-01T19:03:43Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: de9dac7203

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Copilot review overview

🟢 Approval recommended

The shared options are propagated consistently and covered across CLI, pricing, and worker boundaries.

Review effort: Balanced
Findings: None

…model-options # Conflicts: # sdk/typescript/src/cli.ts # sdk/typescript/tests-ts/cli-skills.test.ts

…model-options

…to mdangelo/codex/unify-model-options

…model-options # Conflicts: # plugins/codex-security/mcp-app/tests/test_deep_scan_executor.mjs # sdk/typescript/src/cost-model.ts # sdk/typescript/tests-ts/api.test.ts # sdk/typescript/tests-ts/cost-context.test.ts

mldangelo-oai · 2026-10-01T21:58:58Z

@codex review

chatgpt-codex-connector · 2026-10-01T22:00:42Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 00920985d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Copilot review overview

🟢 Approval recommended

Model settings are propagated consistently and covered across CLI, pricing, and worker boundaries.

Review effort: Balanced
Findings: None

feat(cli): unify model options and support current model pricing

5d31522

mldangelo-oai force-pushed the mdangelo/codex/unify-model-options branch from af2bb4e to 5d31522 Compare October 1, 2026 06:07

mldangelo-oai changed the base branch from mdangelo/codex/simplify-deep-scan to main October 1, 2026 06:07

github-actions Bot added the enhancement New feature or request label Oct 1, 2026

mldangelo-oai requested a balanced review from Copilot October 1, 2026 06:14

Copilot started reviewing on behalf of mldangelo-oai October 1, 2026 06:14

View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread sdk/typescript/src/cli.ts Resolved

soyeon-oai approved these changes Oct 1, 2026

View reviewed changes

mldangelo-oai requested a balanced review from Copilot October 1, 2026 17:55

Copilot started reviewing on behalf of mldangelo-oai October 1, 2026 17:56

View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into mdangelo/codex/unify-…

de9dac7

…model-options # Conflicts: # sdk/typescript/README.md # sdk/typescript/src/cli.ts

mldangelo-oai requested a balanced review from Copilot October 1, 2026 19:01

Copilot started reviewing on behalf of mldangelo-oai October 1, 2026 19:06

View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

mldangelo-oai and others added 5 commits October 1, 2026 20:15

Merge main and resolve CLI model option conflicts

ca1a870

Merge remote-tracking branch 'origin/main' into mdangelo/codex/unify-…

865d1df

…model-options # Conflicts: # sdk/typescript/src/cli.ts # sdk/typescript/tests-ts/cli-skills.test.ts

Merge remote-tracking branch 'origin/main' into mdangelo/codex/unify-…

a27bad5

…model-options

Merge remote-tracking branch 'refs/remotes/pr-cleanup/1143-remote' in…

114aec1

…to mdangelo/codex/unify-model-options

mldangelo-oai requested a balanced review from Copilot October 1, 2026 21:58

Copilot started reviewing on behalf of mldangelo-oai October 1, 2026 22:03

View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

mldangelo-oai merged commit 336fbb9 into main Oct 1, 2026
59 checks passed

mldangelo-oai deleted the mdangelo/codex/unify-model-options branch October 1, 2026 22:29

github-actions Bot mentioned this pull request Oct 1, 2026

chore(release): 0.2.0 #1086

Merged

3 tasks done

Conversation

mldangelo-oai commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Risk and rollout

Public disclosure review

Uh oh!

chatgpt-codex-connector Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

mldangelo-oai commented Oct 1, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

soyeon-oai left a comment

Choose a reason for hiding this comment

Uh oh!

mldangelo-oai commented Oct 1, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

mldangelo-oai commented Oct 1, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

mldangelo-oai commented Oct 1, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mldangelo-oai commented Oct 1, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 1, 2026 •

edited

Loading