Codex Security 0.1.17

Highlights

• Split a large repository into explicit or planned components, scan each one
  independently, and produce a combined coverage report. See
  component scans.
• Supply validation setup, test, and cleanup steps for standard and diff scans.
  See
  custom validation.
• Recheck a saved finding without starting another scan. See
  finding validation.

This release also improves Windows path and process handling, scan result
reporting, credential lock recovery, and Deep Scan recovery. The categorized
list below contains the individual changes.

What's Changed

Features

• feat: add custom validation workflows by @ianw-oai in #590
• feat(sdk): add finding validation by @ianw-oai in #610
• feat: add component scans by @ianw-oai in #584

Fixes

• fix(git): preserve whitespace in worktree paths by @dipeshbabu in #199
• fix(cli): display scan paths with trailing separators by @dipeshbabu in #185
• fix(auth): reject unsupported scan authentication modes by @dipeshbabu in #172
• fix(cli): explain why deep scans stop by @ianw-oai in #577
• fix: reject Windows-ambiguous portable paths by @faizan-oai in #495
• fix: handle Windows multiscan path aliases by @faizan-oai in #496
• fix: canonicalize Windows history and publication paths by @faizan-oai in #497
• fix(cli): emit ok:false envelope for failed history commands by @pasmud in #562
• fix: fall back when Windows hardlinks are unavailable by @faizan-oai in #498
• fix: support stdin in workbench commands by @faizan-oai in #500
• fix(cli): create draft patch pull requests by @ianw-oai in #585
• fix(runtime): recover malformed credential-home lock owners by @mldangelo-oai in #448
• fix(sdk): align scan cost session attribution with log inclusion by @Drewwb in #589
• fix(plugin): make the security access app optional by @ianw-oai in #591
• fix(plugin): start MCP with managed Node by @ianw-oai in #592
• fix(plugin): read Git commit subjects as UTF-8 by @ianw-oai in #593
• fix(plugin): preserve Windows scope and patch behavior by @ianw-oai in #594
• fix(sdk): align scan session attribution rules by @mldangelo-oai in #599
• fix(cli): order update-notice prereleases by SemVer precedence by @Hughhhhcoder in #598
• fix: stream workbench payloads through stdin by @faizan-oai in #587
• fix(windows): parse native tar listings by line by @faizan-oai in #436
• fix(plugin): Preserve recoverable root-cause evidence references by @ianw-oai in #604
• fix: Set SARIF success from coverage by @ianw-oai in #601
• fix: stream CLI validation prompts through stdin by @faizan-oai in #588
• fix: enforce UTF-8 at Windows process boundaries by @faizan-oai in #501
• fix: Save scan instructions before Deep workers start by @ianw-oai in #600
• fix(runtime): reclaim credential-home locks held by a reused PID by @rohanpoudel2 in #611
• fix(plugin): resolve relocated Windows Deep Scan executables by @ianw-oai in #595

Documentation

• docs: require explicit requests for public CLI changes by @mldangelo-oai in #579
• docs(plugin): add independent patch investigation and review by @ianw-oai in #596
• docs: explain Windows ACL snapshot retries by @faizan-oai in #502

Other changes

• refactor(auth): share scan authentication modes by @mldangelo-oai in #582
• refactor(cli): use semver for update notices by @mldangelo-oai in #603
• ci: report test quality and exercise native Bun runners by @mldangelo-oai in #508

New Contributors

• @pasmud made their first contribution in #562
• @Drewwb made their first contribution in #589
• @Hughhhhcoder made their first contribution in #598

Full Changelog: npm-v0.1.16...npm-v0.1.17