fix(triage): honor explicitly selected GitHub connectors

[mldangelo-oai]

Summary

Honor an explicitly selected GitHub Connector, REST account, or credential source instead of silently switching finding intake to another authorization boundary.

Changes

• Keep authenticated GitHub REST as the default intake transport when no explicit transport or account was selected.
• Use read-only connector tools without requiring separate REST credentials when the user explicitly selects the GitHub Connector.
• Preserve an explicitly selected REST account or credential ahead of the default credential priority.
• Ask before falling back to REST, another account, or another credential when an approved transport cannot access the selected repository and source.
• Align the triage skill, its workflow gates, its intake reference, and its final authorization rules.

Testing

• bun test --timeout 30000 tests-ts/runtime.test.ts --test-name-pattern 'keeps installed-package plugin lookup inside the package|projects only the unchanged external payload|creates the SDK marketplace around a validated plugin' passed: three tests and 223 assertions.
• pnpm --pm-on-fail=ignore run types passed.
• pnpm --pm-on-fail=ignore exec prettier --check _bundled_plugin/skills/triage-finding/SKILL.md _bundled_plugin/skills/triage-finding/references/github-rest-intake.md passed.
• Confirmed connector retrieval no longer requires REST auth and explicit account selection overrides credential fallback.
• git diff --check passed.

Risk and rollout

Low risk. This modifies bundled instructions only. Existing default REST intake, source selection, read-only triage, token redaction, and explicit issue selection remain unchanged; explicit user transport and credential choices define the authorization boundary unless another choice is approved.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: b2bd242307

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b2bd242307

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 55869a9dbe

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 55869a9dbe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[zcrab-oai]

Looks good. Explicit GitHub connector, account, and credential selections are honored without silent authorization-boundary fallback.