[mldangelo-oai]

Summary

Before reviewing code, Codex Security builds lists of files to inspect. Some of those lists currently accept only known file extensions, so they can miss files such as a script named scripts/entrypoint or code saved with an unfamiliar extension.

This change checks the file contents to decide whether a file is text. Those files can then be included without adding each extension to a maintained list.

Changes

• Include text files with unfamiliar or no extension when choosing files for review and preparing short previews of their contents. Existing file exclusions still apply.
• Classify complete working-tree files in bounded chunks, so files with binary bytes beyond the preview window are excluded consistently across local and committed scans. Keep previews limited to their existing read budget.
• Check the previous contents of deleted files so deleted text is still included and deleted binary files are skipped.
• Stream file contents from Git while retaining only short previews in memory. Drain rejected binary blobs in bounded chunks so large binary assets do not require a temporary disk copy.

Testing

After rebasing onto main 3a1a51e, all 296 focused inventory, preview, and Git snapshot tests passed. They cover extensionless and unfamiliar text, selected revisions, staged and unstaged changes, deleted text and binary files, gitlinks, bounded blob reads, UTF-16 classification, late binary bytes, and preview byte limits. Large two-way Git pipe traffic, malformed framing, partial output, and Git failures are covered. A discarded 4 MiB binary no longer prevents text inventory generation under a 1 MiB temporary-file size limit.

Ruff checks and formatting, the TypeScript CI build, and portable plugin source compatibility checks passed on this head.

Repeat the focused checks from the repository root:

python -m pytest -q plugins/codex-security/tests/test_generate_in_scope_files.py plugins/codex-security/tests/test_generate_rank_input.py plugins/codex-security/tests/test_rank_preview.py plugins/codex-security/tests/test_workbench_target.py

Risk and rollout

Repositories with previously skipped text files may have more files to review. Existing file exclusions and preview-size limits still apply. Classifying working-tree files now reads through the file until binary content or EOF, which adds I/O for large text files while keeping memory bounded. Reading file versions stored in Git uses bounded chunks and retains only preview samples. Unrecognized formats get short text samples for previews. No command-line changes or migration are required.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T08:59:17.241321Z	3dd9a07	New commits
🔒 Security Review	✅ Completed 2026-10-07T09:01:29.816980Z	3dd9a07	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Reviewed the current diff; no actionable issues found.

[kmbroai]

Reviewed the full inventory/preview change, Git blob framing, deleted-file classification, bounded reads, UTF-16 handling, path checks, and shared regression cases. Local Python validation: 286 passed; six temporary-directory-related failures reproduced on base and all six passed in clean fixtures. Hosted CI inspected. No actionable findings at this commit.

[zcrab-oai]

Reviewed the diff and relevant surrounding code at 9abc6d7. No obvious correctness or regression issues found. 292 focused tests passed locally. Hosted CI remains incomplete because runs were canceled; the failed aggregate checks enforce completion of those canceled jobs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 736e7870fd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".