fix(plugin): improve threat-model instructions across scans

[mldangelo-oai]

Summary

Give full scans, scans of code changes, and the standalone threat-model skill one shared guide. It asks Codex to check how the software works, what an attacker can control, and which protections the code actually enforces. It also tells later scan steps to keep the completed model instead of rebuilding a shorter summary.

Changes

• Ask another agent to check the architecture when one is available. Otherwise, do that review in the main agent.
• Keep supplied models unchanged. A scan with extra context or a narrow scope gets its own model; it does not replace the reusable repository model unless the user asks.
• Include the completed model in saved scan results, including models written in Markdown.
• Count each fully audited file once. Reading a file to understand the architecture does not count as finishing its security review.
• Add tests for saved models, scan completion, and report structure.

Testing

• Focused tests: 62 passed.
• Full randomized suite, seed 12345: 1,294 passed, 11 skipped, 0 failed. The first run hit a local macOS sandbox restriction; the rerun passed.
• pnpm run types, pnpm run format, and git diff --check: passed.
• CI on 50d7914: Linux, macOS, Windows, and container checks passed.
• Previously reported live checks covered excluded files, unchanged supplied models, model reuse, and installed-package behavior.

Risk and rollout

This changes the instructions shipped with the plugin. It does not change the SDK API, saved-result format, dependencies, or report rendering. The extra architecture review may add scan time. Broader evaluation is still needed to measure its effect on scan quality.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

The unchecked item is for private report links already present in bot comments.

[mldangelo-oai]

@codex review

Please review the current head, 10c7252dcd1b0e8d90c04ffac5257ac2e73c45dc.

[mldangelo-oai]

@codex review

The PR title now follows the repository convention. The code is unchanged at 10c7252dcd1b0e8d90c04ffac5257ac2e73c45dc; please review that exact head.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 10c7252dcd

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 10c7252dcd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the current head, 50d79141bf4d37119e398bdd27d0d153d632a9cb.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 50d79141bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 50d79141bf

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Marked ready for review. The code is unchanged at 50d79141bf4d37119e398bdd27d0d153d632a9cb.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 50d79141bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 50d79141bf

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.