chore(codex-security): sync public projection

  - [codex] Add direct Codex Security model selection (#11885...

GitOrigin-Timestamp=2026-07-26T14:32:18-07:00
GitOrigin-RevId: cd6e33602ab57b4a90303f65db4a5e145eb3592d

Author: ianw-oai

README.md

@@ -58,6 +58,7 @@ value, including when no stored sign-in exists.
 Scan a subset of a repository or write machine-readable results:
 
 ```bash
+npx codex-security scan /path/to/repo --model gpt-5.6-terra
 npx codex-security scan /path/to/repo --path src --path tests
 npx codex-security scan /path/to/repo --knowledge-base /path/to/threat-models --knowledge-base /path/to/architecture.pdf
 npx codex-security scan /path/to/repo --diff origin/main --json
@@ -148,11 +149,11 @@ JSON scans remain noninteractive, including when stderr is a terminal. Commands
 that run Codex interactively (`validate`, `patch`, `login`, and `logout`) reject
 `--json`. Write CSV exports to a file when JSON output is selected.
 
-Scans use `gpt-5.6-sol` with extra-high reasoning effort by default. To override
-either setting, pass valid TOML values (including quotes for strings):
+Scans use `gpt-5.6-sol` with extra-high reasoning effort by default. Switch
+models with `--model`. Use `--codex` for other Codex settings:
 
 ```bash
-npx codex-security scan . --codex 'model="gpt-5.6-sol"' --codex 'model_reasoning_effort="high"'
+npx codex-security scan . --model gpt-5.6-terra --codex 'model_reasoning_effort="high"'
 ```
 
 Scans report their requested paths and actual ranking, file-review, validation,

sdk/typescript/README.md

@@ -96,6 +96,7 @@ stored sign-in exists.
 
 ```bash
 npx codex-security scan /path/to/repository
+npx codex-security scan /path/to/repository --model gpt-5.6-terra
 npx codex-security scan /path/to/repository --path src --path tests
 npx codex-security scan /path/to/repository --knowledge-base /path/to/threat-models --knowledge-base /path/to/architecture.pdf
 npx codex-security scan /path/to/repository --diff origin/main --json
@@ -150,9 +151,10 @@ for a passing policy. Incomplete scans still write the available human or JSON
 result to stdout and a coverage warning to stderr, including in report-only
 mode.
 
-Scans use `gpt-5.6-sol` with extra-high reasoning effort by default. Override
-either setting with repeatable `--codex KEY=VALUE` options, for example
-`--codex 'model="gpt-5.6-sol"' --codex 'model_reasoning_effort="high"'`.
+Scans use `gpt-5.6-sol` with extra-high reasoning effort by default. Use
+`--model gpt-5.6-terra` to switch models. Use repeatable `--codex KEY=VALUE`
+options for other Codex settings, such as
+`--codex 'model_reasoning_effort="high"'`.
 
 Scan progress identifies the requested paths and reports actual ranking,
 file-review, validation, and attack-path phases as they become available.

sdk/typescript/package.json

@@ -46,7 +46,7 @@
     "generate:models": "node scripts/generate-models.cjs",
     "generate:models:check": "node scripts/generate-models.cjs --check",
     "lint": "tsc --noEmit",
-    "test": "bun test --timeout 30000 tests-ts/api.test.ts tests-ts/auth.test.ts tests-ts/bulk-scan-discovery.test.ts tests-ts/cli.test.ts tests-ts/config.test.ts tests-ts/contract.test.ts tests-ts/knowledge-base.test.ts tests-ts/multiscan.test.ts tests-ts/result.test.ts tests-ts/runtime.test.ts tests-ts/scan-comparison.test.ts tests-ts/scan-history-renderer.test.ts tests-ts/skeleton.test.ts tests-ts/targets.test.ts tests-ts/trusted-executable.test.ts tests-ts/worker-progress.test.ts",
+    "test": "bun test --timeout 30000 tests-ts/api.test.ts tests-ts/auth.test.ts tests-ts/bulk-scan-discovery.test.ts tests-ts/cli-export.test.ts tests-ts/cli.test.ts tests-ts/config.test.ts tests-ts/contract.test.ts tests-ts/knowledge-base.test.ts tests-ts/multiscan.test.ts tests-ts/result.test.ts tests-ts/runtime.test.ts tests-ts/scan-comparison.test.ts tests-ts/scan-history-renderer.test.ts tests-ts/skeleton.test.ts tests-ts/targets.test.ts tests-ts/trusted-executable.test.ts tests-ts/worker-progress.test.ts",
     "types": "pnpm run generate:models:check && tsc --noEmit"
   },
   "dependencies": {

sdk/typescript/src/cli.ts

@@ -125,6 +125,7 @@ const VALUE_OPTIONS = new Set([
   "--head",
   "--base",
   "--mode",
+  "--model",
   "--output-dir",
   "--plugin-path",
   "--python",
@@ -155,6 +156,7 @@ interface ScanArguments {
   head?: string;
   base?: string;
   mode: ScanMode;
+  model?: string;
   outputDir?: string;
   archiveExisting: boolean;
   pluginPath?: string;
@@ -796,6 +798,9 @@ export async function main(
             .enum(["standard", "deep"])
             .default("standard")
             .describe("Scan mode."),
+          model: optionValue("--model")
+            .optional()
+            .describe("Model to use for the scan."),
           outputDir: optionValue("--output-dir")
             .optional()
             .describe("Write scan artifacts to DIR."),
@@ -852,6 +857,7 @@ export async function main(
         ),
       examples: [
         { args: { repository: "." } },
+        { args: { repository: "." }, options: { model: "gpt-5.6-terra" } },
         { args: { repository: "." }, options: { path: ["src", "tests"] } },
         { args: { repository: "." }, options: { diff: "origin/main" } },
       ],
@@ -874,6 +880,7 @@ export async function main(
             head: options.head,
             base: options.base,
             mode: options.mode,
+            model: options.model,
             outputDir: options.outputDir,
             archiveExisting: options.archiveExisting,
             pluginPath: options.pluginPath,
@@ -918,6 +925,9 @@ export async function main(
           .describe("Directory for scan artifacts and resumable results."),
         workers: z.number().int().positive().default(4),
         mode: z.enum(["standard", "deep"]).default("standard"),
+        model: optionValue("--model")
+          .optional()
+          .describe("Model to use for each repository."),
         maxAttempts: z
           .number()
           .int()
@@ -947,9 +957,16 @@ export async function main(
           let outputDir: string;
           let githubHost: string | undefined;
           if (args.input === undefined) {
-            if (argv.length !== 1 || argv[0] !== "bulk-scan") {
+            if (
+              argv[0] !== "bulk-scan" ||
+              !(
+                argv.length === 1 ||
+                (argv.length === 3 && argv[1] === "--model") ||
+                (argv.length === 2 && argv[1] === `--model=${options.model}`)
+              )
+            ) {
               throw new Error(
-                "Run 'codex-security bulk-scan' without options to discover repositories, or provide a CSV and --output-dir.",
+                "Run 'codex-security bulk-scan [--model MODEL]' to discover repositories, or provide a CSV and --output-dir.",
               );
             }
             const wizard = await runBulkScanWizard(
@@ -984,7 +1001,7 @@ export async function main(
             config: {
               pluginPath: options.pluginPath,
               pythonPath: options.python,
-              codexOverrides: parseCodexOverrides(options.codex),
+              codexOverrides: parseCodexOverrides(options.codex, options.model),
             },
             createSecurity: dependencies.createSecurity,
             signal: controller.signal,
@@ -2021,7 +2038,8 @@ async function runScan(
       pluginPath: arguments_.pluginPath,
       pythonPath: arguments_.pythonPath,
       codexOverrides:
-        arguments_.codexOverrides ?? parseCodexOverrides(arguments_.codex),
+        arguments_.codexOverrides ??
+        parseCodexOverrides(arguments_.codex, arguments_.model),
     };
     progress = new Progress(errorOutput, dependencies, interactive);
     const scope = scanScope(arguments_);
@@ -2402,8 +2420,12 @@ function targetFromArguments(arguments_: ScanArguments): ScanTarget {
   return "repository";
 }
 
-export function parseCodexOverrides(values: readonly string[]): JsonObject {
+export function parseCodexOverrides(
+  values: readonly string[],
+  model?: string,
+): JsonObject {
   const result = Object.create(null) as JsonObject;
+  if (model !== undefined) result["model"] = model;
   for (const value of values) {
     const separator = value.indexOf("=");
     const key = separator < 0 ? "" : value.slice(0, separator);
@@ -2451,7 +2473,11 @@ export function parseCodexOverrides(values: readonly string[]): JsonObject {
     }
     const final = parts.at(-1)!;
     if (Object.hasOwn(cursor, final)) {
-      throw new CodexSecurityError("Duplicate --codex key");
+      throw new CodexSecurityError(
+        model !== undefined && key === "model"
+          ? "--model conflicts with --codex model"
+          : "Duplicate --codex key",
+      );
     }
     cursor[final] = parsed;
   }