feat(cli): make project setup and authentication easier to inspect (#2581)

* feat(cli): expose identifiers for saved scan follow-up

* test(sdk): exercise dedupe representatives in publication

* feat(cli): make project setup and authentication easier to inspect

* docs(cli): distinguish sign-in flows and credential sources

* feat(cli): link interrupted scans and imported evidence to their next commands

* fix(cli): make command help and discovery reflect runnable workflows

* build(sdk): include the command argument helper in package checks

* refactor(cli): reuse shell path quoting for project previews

* docs(cli): identify the shell used for Windows preview commands

* test(cli): account for the internal publication CSV in help coverage

* fix(cli): scope recovery hints to supported sessions and shells

* fix(cli): declare exclusive scan import sources in the schema

* refactor(cli): share credential locking and project preview preparation

* fix(cli): resolve repository arguments consistently during scan discovery

* refactor(cli): simplify the result handoffs and verify PowerShell recovery

* fix(cli): check sign-in from the same directory in every format

* fix(cli): preserve diagnostics when project initialization fails

---------

Co-authored-by: Codex <noreply@openai.com>

Author: mldangelo-oai

docs/project-configuration.md

@@ -36,6 +36,8 @@ codex-security info -c codex-security.yaml --json
 codex-security scan . -c codex-security.yaml --dry-run --json
 ```
 
+The init command prints a preview command using the file it created. On Windows the displayed command uses PowerShell syntax. It includes an editor schema hint when the package is installed in the project. With a global installation the starter contains an empty mapping, which you can replace with your settings. The CLI always validates the file with its bundled schema.
+
 Check that the preview shows your intended repository and scope. To start the
 scan with those settings, keep the same file selection:
 

sdk/typescript/TESTING.md

@@ -12,6 +12,24 @@ pnpm --dir ../../plugins/codex-security/mcp-app install --frozen-lockfile
 
 The commands below run from `sdk/typescript` unless a different directory is named. For a test that builds or loads the bundled plugin, first [download the universal native payload](../../plugins/codex-security/native/README.md#package-inputs). The SDK’s `test`, `test:ci`, `test:mcp` and `prepack` scripts all build that bundle.
 
+## Run the CLI from your checkout
+
+From the repository root, use the source entry point to iterate on commands and help:
+
+```sh
+bun sdk/typescript/src/cli.ts scan --help
+```
+
+For the Node launcher that npm installs as `cs`, build the SDK first:
+
+```sh
+pnpm --dir sdk/typescript run build
+node sdk/typescript/bin/codex-security.mjs scan --help
+node sdk/typescript/bin/codex-security.mjs scan . --dry-run --json
+```
+
+Saved history, exports, and commands that run the bundled plugin also need the native payload described above and `pnpm --dir sdk/typescript run build:plugin`. The `build:ci` script compiles the repository’s CI helpers.
+
 ## Run a focused test
 
 Run the file for the behavior you changed. This example exercises progress parsing:

sdk/typescript/docs/cli.md

@@ -156,6 +156,8 @@ If Codex Security reports that the refresh token was already used, run
 `codex-security logout`, then `codex-security login`. If your Codex CLI or app
 reports that error, sign out and sign back in there.
 
+Use `codex-security login status --json` in automation. Its stdout reports `authenticated`, the effective authentication `method`, and the environment variable name when an API key takes precedence. Native diagnostics go to stderr. The command keeps the exit status of the human-readable status check.
+
 For other refresh errors, check `codex-security login status`. Retry if the
 sign-in recently changed. Otherwise run `codex-security logout`, then
 `codex-security login`.